CVE-2026-80760

A flaw was found in the Linux kernel's Bluetooth Management (MGMT) component. The mgmt_hci_cmd_sync() function incorrectly handles the params_len field, allowing a value greater than 255 to be processed. This mismatch between the declared parameter length and the actual appended data can cause the Bluetooth controller to misinterpret subsequent data as the start of a new packet, potentially leading to unexpected behavior or a denial of service.

Bluetooth MGMT HCI_CMD_SYNC accepted a params_len value that fits the management message but does not fit the u8 parameter length field in the HCI command header. A local actor with access to the Bluetooth management interface could set params_len to more than 255, causing the header length to be truncated while the full parameter bytes are still appended to the outgoing frame. On length framed transports such as H:4, the controller may treat the trailing bytes as the start of another HCI packet, causing command stream desynchronization, unintended controller behavior, or denial of service. For the CVSS the PR:L is used for the paranoid score because reduced capability root, a service account, or delegated Bluetooth management access may be enough in some deployments. The issue is not directly network reachable from a remote Bluetooth peer and does not show a kernel memory corruption primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.