CVE-2026-80761: Linux kernel · Bluetooth: ISO: zero the sockaddr before returning it in getname
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in 554594d032aa4356ca4be75d0cb46e13d350dbd2 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 13:47 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 554594d032aa4356ca4be75d0cb46e13d350dbd2, 9069be87c67f290783b332c4284e09fb89cb9ea7, 884cf2cc957da7ac178a0e6c6c69ddfec0481cc8 +3
Exploitation evidence
Disclosed: evidence found.
CVE published 4 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname iso_sock_getname() fills a struct sockaddr_iso in place and returns its size without clearing it first, so bytes it does not write are copied to user space from the kernel stack. The getsockname(2) and getpeername(2) paths both run through do_getsockname(), which hands getname() an uninitialized sockaddr_storage on the stack and copies back up to the number of bytes getname() returns, so the driver has to initialize every byte it accounts for. Two ranges are left uninitialized: - struct sockaddr_iso is 10 bytes but only 9 are written (family, iso_bdaddr, iso_bdaddr_type), leaking the trailing pad byte on every call. - for a broadcast peer (BIS_LINK or PA_LINK) the returned length grows by sizeof(struct sockaddr_iso_bc), but only bc_sid, bc_num_bis and bc_bis are filled; bc_bdaddr and bc_bdaddr_type, the first 7 bytes of that structure, are never written. An unprivileged process can open a BTPROTO_ISO socket and reach the pad leak with getsockname(); the broadcast leak needs an established BIS/PA connection. l2cap and rfcomm already memset their sockaddr in getname for the same reason; do the same here.
References
- git.kernel.org/stable/c/90be10604936c9042dc6238d8836abafca471811 (opens in a new tab)
- git.kernel.org/stable/c/554594d032aa4356ca4be75d0cb46e13d350dbd2 (opens in a new tab)
- git.kernel.org/stable/c/1f6d1f2611af0eb36b133a41d29ffd2cc2601615 (opens in a new tab)
- git.kernel.org/stable/c/9069be87c67f290783b332c4284e09fb89cb9ea7 (opens in a new tab)
- git.kernel.org/stable/c/190b719b787eb4ca6c25b12fab224806f9108b06 (opens in a new tab)
- git.kernel.org/stable/c/884cf2cc957da7ac178a0e6c6c69ddfec0481cc8 (opens in a new tab)