CVE-2026-80760Low· 2.3▾ SunlitA flaw was found in the Linux kernel's Bluetooth Management (MGMT) component. The `mgmt_hci_cmd_sync()` function incorrectly handles the `params_len` field, allowing a value greater than 255 to be processed. This mismatch between the decla…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 12.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
— → 2.3
none → low
A flaw was found in the Linux kernel's Bluetooth Management (MGMT) component. The mgmt_hci_cmd_sync() function incorrectly handles the params_len field, allowing a value greater than 255 to be processed. This mismatch between the declared parameter length and the actual appended data can cause the Bluetooth controller to misinterpret subsequent data as the start of a new packet, potentially leading to unexpected behavior or a denial of service.
kernel: Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 — rated Moderate by Red Hat. Released 2026-09-04, updated 2026-10-26.
Affected:
No fix planned:
Not affected:
Fix deferred
Workarounds / mitigations:
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80805Medium· 4.4kernel: xfs: validate attr entry pointer before field access (CVE-2026-80805)
CVE-2026-80765Medium· 4.4kernel: HID: hyperv: validate initial device info bounds (CVE-2026-80765)
CVE-2026-74620Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gact, act_police: range check the fallback control action tcf_action_check_ctrlact() range checks the primary control action: if (!opcode) ret = act…
CVE-2026-116172Medium· 5.9vllm: vLLM: Denial of Service via improper input validation in Rust gRPC interface (CVE-2026-116172)
CVE-2026-116174Medium· 5.9vllm: vllm: Denial of Service via invalid prompt token IDs in gRPC service (CVE-2026-116174)
CVE-2026-106071Low· 3.6nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)