CVE-2026-31497
Out-of-Bounds Read in Linux btusb SCO Altsetting Lookup
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.8 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.168 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.131 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.80 (exc) |
| linux | linux_kernel | From 5.8.1 (inc) to 5.10.253 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Bluetooth USB driver (btusb). The function btusb_work() uses a lookup table with three entries to map the number of active SCO (Synchronous Connection-Oriented) links to USB alternate settings when handling CVSD traffic with transparent voice settings.
The issue arises because the code indexes the lookup table using data->sco_num - 1 without first ensuring that sco_num is within the valid range of the table entries. Since the table only supports up to three SCO links, if sco_num exceeds this, the code may read beyond the bounds of the table.
The fix involves capping the lookup index to the last valid table entry, preventing out-of-bounds access and ensuring the driver selects the highest supported alternate setting without reading past the table.
How can this vulnerability impact me? :
This vulnerability could lead to out-of-bounds memory access in the Bluetooth USB driver when handling SCO links. Such memory access issues can potentially cause system instability, crashes, or unexpected behavior in Bluetooth functionality.
While the description does not explicitly mention exploitation scenarios, improper memory access in kernel code can sometimes be leveraged for privilege escalation or denial of service attacks.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved in the Linux kernel by clamping the SCO altsetting table indices to prevent out-of-bounds access.
To mitigate this vulnerability immediately, you should update your Linux kernel to the latest version that includes this fix.