Submit finding

All findings

CVE-2026-80794, CVE-2026-80795, CVE-2026-64433 high

Three Linux CVEs carry direct Bynario AI assistance credits

Accepted Linux patches for two NFC/NCI flaws and a Bluetooth management use-after-free contain explicit Assisted-by: Bynario AI trailers.

Bug class
Uninitialized-data exposure, array-bounds violation, and use-after-free
Affected codebase
Linux kernel NFC/NCI and Bluetooth subsystems
Credited system
Bynario AI
Latest disclosure
September 4, 2026
Coverage
CVE publication dates July 25-September 4, 2026
Attribution
Direct source attribution
AI role
Mixed roles
Severity
high
Source status: All three CVEs have public records and accepted Linux patches with explicit Assisted-by: Bynario AI trailers. The trailers establish assistance, while Bynario's research pages provide the surrounding workflow.

Summary

CVE-2026-80794 covers uninitialized NFC/NCI notification data exposed through target records. CVE-2026-80795 covers a discovered-target array-bounds flaw. CVE-2026-64433 is a Bluetooth MGMT add_device_complete() use-after-free.

The Bluetooth issue depends on a local privilege and race-sensitive path. The page uses the high label for the grouped set but does not import Bynario’s tracker score as a definitive threat model for every deployment.

Attribution boundary

The accepted patches establish direct Bynario AI assistance. An Assisted-by trailer alone does not establish autonomous discovery, so this entry describes the mixed reporting, analysis, and patch workflow without claiming that Bynario was the sole finder.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.