CVE-2026-74300— 蓝牙 hci 编解码能力元素长度验证漏洞
可能的 ATT&CK 技术 1AI
T1210 · Exploitation of Remote Services影响版本矩阵 14
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 8961987f3f5fa2f2618e72304d013c8dd5e604a6< fc97fc8cf7f53fd3619db63e09050d20a3a0c4b1 | affected |
8961987f3f5fa2f2618e72304d013c8dd5e604a6< 290b36f9d1eb9b2f72b40d826f26b4a182ab15f7 | affected | ||
8961987f3f5fa2f2618e72304d013c8dd5e604a6< f2ad01f55e07f9531efcea736087e6b8658a3440 | affected | ||
8961987f3f5fa2f2618e72304d013c8dd5e604a6< ec4d352747a62c1082f16c11a74b37d6eb85a5a3 | affected | ||
8961987f3f5fa2f2618e72304d013c8dd5e604a6< 4bc16db0f11918e07edf9fdcda4a30cf4c9df45c | affected | ||
8961987f3f5fa2f2618e72304d013c8dd5e604a6< c38fbcdc407925c7088f7e5f11c1fff73d2d35a2 | affected | ||
5.16 | affected | ||
< 5.16 | unaffected | ||
| … +6 条更多 | |||
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2026-74300 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Bluetooth: hci: validate codec capability element length
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci_read_codec_capabilities() checks that the skb contains the length byte, but then validates only caps->len against the remaining skb length. A malformed controller response with one remaining byte and caps->len set to one passes that check even though the element needs two bytes. The parser then records a two-byte capability and copies one byte beyond the advertised response payload into the codec list. Validate the full element size, including the length byte, before adding it to the accumulated capability length. This preserves all well-formed capability elements and drops only truncated controller responses.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-74300 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-74300 的情报信息
请登录查看更多情报信息。
CVE-2026-74300 补丁与修复 (6)
同批安全公告 · Linux · 2026-08-15 · 共 848 条
| CVE-2026-72255 | netfilter nf_queue 桥接设备 pin 漏洞 | |
| CVE-2026-72268 | t dfxfb tdfxfb_probe 内存泄漏漏洞 | |
| CVE-2026-72267 | fbdev carminefb alloc_carmine_fb()潜在内存泄漏漏洞 | |
| CVE-2026-72266 | vesafb: vesafb_probe() 内存泄漏漏洞 | |
| CVE-2026-72265 | NVIDIA fbdev 驱动 nvidiafb_probe 内存泄漏漏洞 | |
| CVE-2026-72264 | tridentfb：trident_pci_probe() 潜在内存泄漏 | |
| CVE-2026-72262 | ASoC: SOF: bytes_ext 堆溢出漏洞 | |
| CVE-2026-72263 | ASoC SOF拓扑内存泄漏漏洞 | |
| CVE-2026-72261 | ASoC SOF ipc3-control 验证 snd_sof_update_control 中的大小 | |
| CVE-2026-72260 | Mediatek MT8192 SoC驱动运行时恢复检查漏洞 | |
| CVE-2026-72259 | mediatek mt8192 资源释放漏洞 | |
| CVE-2026-72258 | MT8183内存清理释放漏洞 | |
| CVE-2026-72256 | netfilter xt_cluster 哈希匹配中拒绝模板连接跟踪漏洞 | |
| CVE-2026-72257 | qcom q6apm NULL指针解引用漏洞 | |
| CVE-2026-72245 | host1x: host1x_device_parse_dt() 设备引用泄露漏洞 | |
| CVE-2026-72248 | netfilter flowtable IPIP隧道直接转发漏洞 | |
| CVE-2026-72247 | Linux内核 nf_conncount 连接数模块元组去重时区域比较逻辑错误漏洞 | |
| CVE-2026-72246 | netfilter flowtable 隧道路由方向设置错误漏洞 | |
| CVE-2026-72249 | netfilter flowtable IPIP头部推送方向目标地址使用漏洞 | |
| CVE-2026-72244 | gpu/buddy：对齐失败时终止try_harder |
显示前 20 条，共 848 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-74300
暂无评论