CVE-2026-74300

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci: validate codec capability element length<br /> <br /> Read Local Codec Capabilities returns a sequence of capability elements.<br /> Each element starts with a one-byte length followed by that many payload<br /> bytes.<br /> <br /> hci_read_codec_capabilities() checks that the skb contains the length<br /> byte, but then validates only caps-&gt;len against the remaining skb<br /> length. A malformed controller response with one remaining byte and<br /> caps-&gt;len set to one passes that check even though the element needs two<br /> bytes. The parser then records a two-byte capability and copies one<br /> byte beyond the advertised response payload into the codec list.<br /> <br /> Validate the full element size, including the length byte, before adding<br /> it to the accumulated capability length. This preserves all well-formed<br /> capability elements and drops only truncated controller responses.