CVE-2026-74300

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-74300

Key Details

CVE	CVE-2026-74300
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is adjacent; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci: validate codec capability element length

Read Local Codec Capabilities returns a sequence of capability elements.

Each element starts with a one-byte length followed by that many payload

bytes.

hci_read_codec_capabilities() checks that the skb contains the length

byte, but then validates only caps->len against the remaining skb

length. A malformed controller response with one remaining byte and

caps->len set to one passes that check even though the element needs two

bytes. The parser then records a two-byte capability and copies one

byte beyond the advertised response payload into the codec list.

Validate the full element size, including the length byte, before adding

it to the accumulated capability length. This preserves all well-formed

capability elements and drops only truncated controller responses. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-74300
CVE	https://www.cve.org/CVERecord?id=CVE-2026-74300

Source

Reference

NVD

CVE