Improper Input Validation Affecting kernel-rt-64k-debug-modules-extra package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CENTOS10-KERNELRT64KDEBUGMODULESEXTRA-21714416
- published26 Oct 2026
- disclosed4 Sept 2026
Introduced: 4 Sep 2026
CVE-2026-80760 (opens in a new tab)How to fix?
There is no fixed version for Centos:10 kernel-rt-64k-debug-modules-extra.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-rt-64k-debug-modules-extra package and not the kernel-rt-64k-debug-modules-extra package as distributed by Centos.
See How to fix? for Centos:10 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
mgmt_hci_cmd_sync() checks that the message length agrees with params_len but puts no upper bound on it. params_len is __le16 while the parameter length in the HCI command header is a u8:
struct hci_command_hdr {
__le16 opcode;
__u8 plen;
} __packed;
hci_cmd_sync_alloc() assigns one to the other:
hdr->plen = plen;
if (plen) skb_put_data(skb, param, plen);
so a params_len of 256 leaves plen at 0 while all 256 bytes are still appended. The frame handed to the driver then declares no parameters and carries 256 of them. On a length framed transport such as H:4 the controller takes the trailing bytes as the start of the next packet.
The mgmt socket MTU is HCI_MAX_FRAME_SIZE, so params_len can reach about 1KB this way. Commit 03f1700b9b4d ("Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands") only made params_len agree with the message length, a value that fits the message but not the header field is still accepted.
Reject params_len that does not fit the header field.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2528596
- https://access.redhat.com/security/cve/CVE-2026-80760
- https://git.kernel.org/stable/c/0bd0195ce25737cbdd0eabc54319ee0ddf3a0ad2
- https://git.kernel.org/stable/c/5d95286b6d6e8f1d304da7522bfa6860fc017e48
- https://git.kernel.org/stable/c/6e1c44878aa3ee7336efeaf01414b030b0a5c273
- https://git.kernel.org/stable/c/b7d9edcf9fe6e9ec3a2e80ef9e8d44ef9b4f2894