CVE-2026-31393
Out-of-Bounds Read in Linux Kernel Bluetooth L2CAP Component
Publication date: 2026-04-03
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Bluetooth L2CAP implementation. Specifically, the function l2cap_information_rsp() does not properly validate the length of the L2CAP_INFO_RSP payload before accessing its data.
The function checks that the command length covers the fixed header (4 bytes), but then reads additional payload data without verifying that the payload is actually present. This can lead to out-of-bounds reads when the payload is truncated.
For example, certain fields like L2CAP_IT_FEAT_MASK and L2CAP_IT_FIXED_CHAN read bytes beyond the header, requiring the payload to be at least 8 or 5 bytes respectively. If the payload is shorter, an out-of-bounds read of adjacent memory occurs.
The fix involves adding proper payload length checks before accessing the data. If the payload is too short, the read is skipped and safe default values are used, preventing the connection from stalling.
How can this vulnerability impact me? :
This vulnerability can cause out-of-bounds memory reads in the Bluetooth L2CAP protocol handling within the Linux kernel.
Such out-of-bounds reads may lead to information disclosure by reading adjacent memory data unintentionally.
Additionally, improper handling of this condition could potentially cause instability or crashes in the Bluetooth stack, possibly affecting the reliability of Bluetooth connections.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by validating the L2CAP_INFO_RSP payload length before accessing it in the Linux kernel Bluetooth L2CAP implementation.
To mitigate this vulnerability immediately, ensure your Linux kernel is updated to a version that includes this fix.
If updating is not immediately possible, avoid using Bluetooth L2CAP features that may trigger the vulnerable code, though this may impact functionality.