---
id: CVE-2026-80759
title: 'Bluetooth: hci_aml: validate firmware segment lengths'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_aml: validate firmware segment lengths

  aml_download_firmware() reads two lengths from the firmware header and
  uses them to build pointers before checkin…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 37bac77e4649e8158698a60addc22ec4faf5649a <
    7733b01ed13685773ccda91035a46f87d4cfef7c
  - >-
    Linux >= 37bac77e4649e8158698a60addc22ec4faf5649a <
    e1534d49a7b8ba728e84b020f6d802aa1cb759d9
  - >-
    Linux >= 37bac77e4649e8158698a60addc22ec4faf5649a <
    6c70253462902d835e843b470f74aa816d60af80
  - >-
    Linux >= 37bac77e4649e8158698a60addc22ec4faf5649a <
    2763b8bcb504e30ec955474f51b99ce42fc62f3b
  - >-
    Linux >= 37bac77e4649e8158698a60addc22ec4faf5649a <
    2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4
  - Linux 6.12
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:43:15.994Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80759'
references:
  - url: 'https://git.kernel.org/stable/c/7733b01ed13685773ccda91035a46f87d4cfef7c'
  - url: 'https://git.kernel.org/stable/c/e1534d49a7b8ba728e84b020f6d802aa1cb759d9'
  - url: 'https://git.kernel.org/stable/c/6c70253462902d835e843b470f74aa816d60af80'
  - url: 'https://git.kernel.org/stable/c/2763b8bcb504e30ec955474f51b99ce42fc62f3b'
  - url: 'https://git.kernel.org/stable/c/2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4'
tags:
  - cve.org
epss: 0.00168
epssPercentile: 0.05666
ingestedAt: '2026-10-19T10:20:54.950Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_aml: validate firmware segment lengths

aml_download_firmware() reads two lengths from the firmware header and
uses them to build pointers before checking that the header and segment
data are present. A truncated or inconsistent firmware image can make
the driver read past firmware->data while constructing TCI commands.

Reject images shorter than the header and ensure that the ICCM and DCCM
ranges fit within the loaded firmware before downloading either segment.

## Affected

- `Linux >= 37bac77e4649e8158698a60addc22ec4faf5649a < 7733b01ed13685773ccda91035a46f87d4cfef7c`
- `Linux >= 37bac77e4649e8158698a60addc22ec4faf5649a < e1534d49a7b8ba728e84b020f6d802aa1cb759d9`
- `Linux >= 37bac77e4649e8158698a60addc22ec4faf5649a < 6c70253462902d835e843b470f74aa816d60af80`
- `Linux >= 37bac77e4649e8158698a60addc22ec4faf5649a < 2763b8bcb504e30ec955474f51b99ce42fc62f3b`
- `Linux >= 37bac77e4649e8158698a60addc22ec4faf5649a < 2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.