Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname… (CVE-2026-80761)

The Linux kernel Bluetooth ISO socket function iso_sock_getname() failed to clear the entire sockaddr_iso structure before returning it, resulting in uninitialized kernel stack bytes being copied to user space. This occurs because iso_sock_getname() writes only 9 of the 10 bytes of sockaddr_iso, leaving a trailing pad byte uninitialized. Additionally, for broadcast peers, some fields in sockaddr_iso_bc remain uninitialized. Unprivileged processes can exploit this by opening a BTPROTO_ISO socket and calling getsockname(), potentially leaking kernel stack data. The vulnerability was fixed by zeroing the sockaddr structure before returning it, aligning with similar fixes in l2cap and rfcomm Bluetooth drivers.

The vulnerability allows an unprivileged local user to leak uninitialized kernel stack memory contents to user space via Bluetooth ISO socket calls. This information leak could potentially expose sensitive kernel memory data. However, exploitation requires local access and specific socket usage. There is no indication of remote exploitation or privilege escalation from this vulnerability.

A fix has been implemented in the Linux kernel to zero the sockaddr structure before returning it in the getname function for Bluetooth ISO sockets. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level fix, updating to a patched kernel version is the recommended remediation. No additional mitigations are indicated.