CVE-2026-31498

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31498", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.103Z", "datePublished": "2026-04-22T13:54:19.714Z", "dateUpdated": "2026-11-05T21:45:03.103Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:05:11.217Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop\n\nl2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED\nstate to support L2CAP reconfiguration (e.g. MTU changes). However,\nsince both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from\nthe initial configuration, the reconfiguration path falls through to\nl2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and\nretrans_list without freeing the previous allocations and sets\nchan->sdu to NULL without freeing the existing skb. This leaks all\npreviously allocated ERTM resources.\n\nAdditionally, l2cap_parse_conf_req() does not validate the minimum\nvalue of remote_mps derived from the RFC max_pdu_size option. A zero\nvalue propagates to l2cap_segment_sdu() where pdu_len becomes zero,\ncausing the while loop to never terminate since len is never\ndecremented, exhausting all available memory.\n\nFix the double-init by skipping l2cap_ertm_init() and\nl2cap_chan_ready() when the channel is already in BT_CONNECTED state,\nwhile still allowing the reconfiguration parameters to be updated\nthrough l2cap_parse_conf_req(). Also add a pdu_len zero check in\nl2cap_segment_sdu() as a safeguard."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/l2cap_core.c"], "versions": [{"version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "9760b83cfd24b38caee663f429011a0dd6064fa9", "status": "affected", "versionType": "git"}, {"version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "de37e2655b7abc3f59254c6b72256840f39fc6d5", "status": "affected", "versionType": "git"}, {"version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "e7aab23b7df89a3d754a5f0a7d2237548b328bd0", "status": "affected", "versionType": "git"}, {"version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "52667c859fe33f70c2e711cb81bbd505d5eb8e75", "status": "affected", "versionType": "git"}, {"version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "9a21a631ee034b1573dce14b572a24943dbfd7ae", "status": "affected", "versionType": "git"}, {"version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "900e4db5385ec2cacd372345a80ab9c8e105b3a3", "status": "affected", "versionType": "git"}, {"version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "042e2cd4bb11e5313b19b87593616524949e4c52", "status": "affected", "versionType": "git"}, {"version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "25f420a0d4cfd61d3d23ec4b9c56d9f443d91377", "status": "affected", "versionType": "git"}, {"version": "4ad03ff6f680681c5f78254e37c4c856fa953629", "status": "affected", "versionType": "git"}, {"version": "b7d0ca715c1008acd2fc018f02a56fed88f78b75", "status": "affected", "versionType": "git"}, {"version": "799263eb37a4f7f6d39334046929c3bc92452a7f", "status": "affected", "versionType": "git"}, {"version": "8828622fb9b4201eeb0870587052e3d834cfaf61", "status": "affected", "versionType": "git"}, {"version": "b432ea85ab8472763870dd0f2c186130dd36d68c", "status": "affected", "versionType": "git"}, {"version": "4.4.238", "lessThan": "4.5", "status": "affected", "versionType": "semver"}, {"version": "4.9.238", "lessThan": "4.10", "status": "affected", "versionType": "semver"}, {"version": "4.14.200", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.19.149", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.69", "lessThan": "5.5", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/l2cap_core.c"], "versions": [{"version": "5.7", "status": "affected"}, {"version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.131", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.1.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.6.131"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.238"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.238"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.200"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.69"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9760b83cfd24b38caee663f429011a0dd6064fa9"}, {"url": "https://git.kernel.org/stable/c/de37e2655b7abc3f59254c6b72256840f39fc6d5"}, {"url": "https://git.kernel.org/stable/c/e7aab23b7df89a3d754a5f0a7d2237548b328bd0"}, {"url": "https://git.kernel.org/stable/c/52667c859fe33f70c2e711cb81bbd505d5eb8e75"}, {"url": "https://git.kernel.org/stable/c/9a21a631ee034b1573dce14b572a24943dbfd7ae"}, {"url": "https://git.kernel.org/stable/c/900e4db5385ec2cacd372345a80ab9c8e105b3a3"}, {"url": "https://git.kernel.org/stable/c/042e2cd4bb11e5313b19b87593616524949e4c52"}, {"url": "https://git.kernel.org/stable/c/25f420a0d4cfd61d3d23ec4b9c56d9f443d91377"}], "title": "Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31498", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:35:45.390526Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:45:03.103Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31498", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:35:45.390526Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:35:46.975Z"}}], "cna": {"title": "Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "9760b83cfd24b38caee663f429011a0dd6064fa9", "versionType": "git"}, {"status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "de37e2655b7abc3f59254c6b72256840f39fc6d5", "versionType": "git"}, {"status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "e7aab23b7df89a3d754a5f0a7d2237548b328bd0", "versionType": "git"}, {"status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "52667c859fe33f70c2e711cb81bbd505d5eb8e75", "versionType": "git"}, {"status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "9a21a631ee034b1573dce14b572a24943dbfd7ae", "versionType": "git"}, {"status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "900e4db5385ec2cacd372345a80ab9c8e105b3a3", "versionType": "git"}, {"status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "042e2cd4bb11e5313b19b87593616524949e4c52", "versionType": "git"}, {"status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "lessThan": "25f420a0d4cfd61d3d23ec4b9c56d9f443d91377", "versionType": "git"}, {"status": "affected", "version": "4ad03ff6f680681c5f78254e37c4c856fa953629", "versionType": "git"}, {"status": "affected", "version": "b7d0ca715c1008acd2fc018f02a56fed88f78b75", "versionType": "git"}, {"status": "affected", "version": "799263eb37a4f7f6d39334046929c3bc92452a7f", "versionType": "git"}, {"status": "affected", "version": "8828622fb9b4201eeb0870587052e3d834cfaf61", "versionType": "git"}, {"status": "affected", "version": "b432ea85ab8472763870dd0f2c186130dd36d68c", "versionType": "git"}, {"status": "affected", "version": "4.4.238", "lessThan": "4.5", "versionType": "semver"}, {"status": "affected", "version": "4.9.238", "lessThan": "4.10", "versionType": "semver"}, {"status": "affected", "version": "4.14.200", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "4.19.149", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.4.69", "lessThan": "5.5", "versionType": "semver"}], "programFiles": ["net/bluetooth/l2cap_core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"status": "unaffected", "version": "0", "lessThan": "5.7", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.168", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.131", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.80", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/l2cap_core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9760b83cfd24b38caee663f429011a0dd6064fa9"}, {"url": "https://git.kernel.org/stable/c/de37e2655b7abc3f59254c6b72256840f39fc6d5"}, {"url": "https://git.kernel.org/stable/c/e7aab23b7df89a3d754a5f0a7d2237548b328bd0"}, {"url": "https://git.kernel.org/stable/c/52667c859fe33f70c2e711cb81bbd505d5eb8e75"}, {"url": "https://git.kernel.org/stable/c/9a21a631ee034b1573dce14b572a24943dbfd7ae"}, {"url": "https://git.kernel.org/stable/c/900e4db5385ec2cacd372345a80ab9c8e105b3a3"}, {"url": "https://git.kernel.org/stable/c/042e2cd4bb11e5313b19b87593616524949e4c52"}, {"url": "https://git.kernel.org/stable/c/25f420a0d4cfd61d3d23ec4b9c56d9f443d91377"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop\n\nl2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED\nstate to support L2CAP reconfiguration (e.g. MTU changes). However,\nsince both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from\nthe initial configuration, the reconfiguration path falls through to\nl2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and\nretrans_list without freeing the previous allocations and sets\nchan->sdu to NULL without freeing the existing skb. This leaks all\npreviously allocated ERTM resources.\n\nAdditionally, l2cap_parse_conf_req() does not validate the minimum\nvalue of remote_mps derived from the RFC max_pdu_size option. A zero\nvalue propagates to l2cap_segment_sdu() where pdu_len becomes zero,\ncausing the while loop to never terminate since len is never\ndecremented, exhausting all available memory.\n\nFix the double-init by skipping l2cap_ertm_init() and\nl2cap_chan_ready() when the channel is already in BT_CONNECTED state,\nwhile still allowing the reconfiguration parameters to be updated\nthrough l2cap_parse_conf_req(). Also add a pdu_len zero check in\nl2cap_segment_sdu() as a safeguard."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.131", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.80", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.4.238"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.9.238"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.14.200"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.149"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.69"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:05:11.217Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31498", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:45:03.103Z", "dateReserved": "2026-03-09T15:48:24.103Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:54:19.714Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/l2cap_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9760b83cfd24b38caee663f429011a0dd6064fa9", "status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "versionType": "git"}, {"lessThan": "de37e2655b7abc3f59254c6b72256840f39fc6d5", "status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "versionType": "git"}, {"lessThan": "e7aab23b7df89a3d754a5f0a7d2237548b328bd0", "status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "versionType": "git"}, {"lessThan": "52667c859fe33f70c2e711cb81bbd505d5eb8e75", "status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "versionType": "git"}, {"lessThan": "9a21a631ee034b1573dce14b572a24943dbfd7ae", "status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "versionType": "git"}, {"lessThan": "900e4db5385ec2cacd372345a80ab9c8e105b3a3", "status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "versionType": "git"}, {"lessThan": "042e2cd4bb11e5313b19b87593616524949e4c52", "status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "versionType": "git"}, {"lessThan": "25f420a0d4cfd61d3d23ec4b9c56d9f443d91377", "status": "affected", "version": "96298f640104e4cd9a913a6e50b0b981829b94ff", "versionType": "git"}, {"status": "affected", "version": "4ad03ff6f680681c5f78254e37c4c856fa953629", "versionType": "git"}, {"status": "affected", "version": "b7d0ca715c1008acd2fc018f02a56fed88f78b75", "versionType": "git"}, {"status": "affected", "version": "799263eb37a4f7f6d39334046929c3bc92452a7f", "versionType": "git"}, {"status": "affected", "version": "8828622fb9b4201eeb0870587052e3d834cfaf61", "versionType": "git"}, {"status": "affected", "version": "b432ea85ab8472763870dd0f2c186130dd36d68c", "versionType": "git"}, {"lessThan": "4.5", "status": "affected", "version": "4.4.238", "versionType": "semver"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.238", "versionType": "semver"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.200", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.149", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.69", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/l2cap_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.168", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.131", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.80", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "06D736F2-3AF9-405C-A2D4-D7A433966CD1", "versionEndExcluding": "4.5", "versionStartIncluding": "4.4.238", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C239C4E4-A9BE-4BA4-B0ED-58C96D32A965", "versionEndExcluding": "4.10", "versionStartIncluding": "4.9.238", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E4C219D0-2F4C-4842-85C7-5EE4D0099F82", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.200", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "22D98FED-AEF1-4722-8A24-E84AEFBAE267", "versionEndExcluding": "4.20", "versionStartIncluding": "4.19.149", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20BCB29D-C30A-4880-8FC2-2468E283C95D", "versionEndExcluding": "5.5", "versionStartIncluding": "5.4.69", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "44827F4D-4242-412D-B59A-6D9F5FC547B1", "versionEndExcluding": "5.10.253", "versionStartIncluding": "5.7.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B", "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE6ED4D4-0046-4573-BFA9-D64143B6A89F", "versionEndExcluding": "6.6.131", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.7:-:*:*:*:*:*:*", "matchCriteriaId": "3D23CE42-BDB2-4216-8495-230ABE98FCDD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop\n\nl2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED\nstate to support L2CAP reconfiguration (e.g. MTU changes). However,\nsince both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from\nthe initial configuration, the reconfiguration path falls through to\nl2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and\nretrans_list without freeing the previous allocations and sets\nchan->sdu to NULL without freeing the existing skb. This leaks all\npreviously allocated ERTM resources.\n\nAdditionally, l2cap_parse_conf_req() does not validate the minimum\nvalue of remote_mps derived from the RFC max_pdu_size option. A zero\nvalue propagates to l2cap_segment_sdu() where pdu_len becomes zero,\ncausing the while loop to never terminate since len is never\ndecremented, exhausting all available memory.\n\nFix the double-init by skipping l2cap_ertm_init() and\nl2cap_chan_ready() when the channel is already in BT_CONNECTED state,\nwhile still allowing the reconfiguration parameters to be updated\nthrough l2cap_parse_conf_req(). Also add a pdu_len zero check in\nl2cap_segment_sdu() as a safeguard."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: L2CAP: Correcci\u00f3n de la reinicializaci\u00f3n de ERTM y bucle infinito con pdu_len cero\n\nl2cap_config_req() procesa CONFIG_REQ para canales en estado BT_CONNECTED para soportar la reconfiguraci\u00f3n de L2CAP (p. ej., cambios de MTU). Sin embargo, dado que tanto CONF_INPUT_DONE como CONF_OUTPUT_DONE ya est\u00e1n establecidos desde la configuraci\u00f3n inicial, la ruta de reconfiguraci\u00f3n pasa a l2cap_ertm_init(), que reinicializa tx_q, srej_q, srej_list y retrans_list sin liberar las asignaciones anteriores y establece chan -> sdu a NULL sin liberar el skb existente. Esto fuga todos los recursos ERTM previamente asignados.\n\nAdem\u00e1s, l2cap_parse_conf_req() no valida el valor m\u00ednimo de remote_mps derivado de la opci\u00f3n max_pdu_size de RFC. Un valor cero se propaga a l2cap_segment_sdu() donde pdu_len se vuelve cero, haciendo que el bucle \u2019while\u2019 nunca termine ya que \u2019len\u2019 nunca se decrementa, agotando toda la memoria disponible.\n\nSe corrige la doble inicializaci\u00f3n omitiendo l2cap_ertm_init() y l2cap_chan_ready() cuando el canal ya est\u00e1 en estado BT_CONNECTED, mientras se sigue permitiendo que los par\u00e1metros de reconfiguraci\u00f3n se actualicen a trav\u00e9s de l2cap_parse_conf_req(). Tambi\u00e9n se a\u00f1ade una comprobaci\u00f3n de pdu_len cero en l2cap_segment_sdu() como salvaguarda."}], "id": "CVE-2026-31498", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31498", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:35:45.390526Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:48.067", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/042e2cd4bb11e5313b19b87593616524949e4c52"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/25f420a0d4cfd61d3d23ec4b9c56d9f443d91377"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/52667c859fe33f70c2e711cb81bbd505d5eb8e75"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/900e4db5385ec2cacd372345a80ab9c8e105b3a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9760b83cfd24b38caee663f429011a0dd6064fa9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9a21a631ee034b1573dce14b572a24943dbfd7ae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/de37e2655b7abc3f59254c6b72256840f39fc6d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e7aab23b7df89a3d754a5f0a7d2237548b328bd0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop", "id": "2460629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460629"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-606", "details": ["A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation. A remote attacker could exploit this by sending a malformed configuration request with a zero-valued maximum PDU (Protocol Data Unit) size. This could lead to an infinite loop, exhausting system memory and causing a denial of service. Additionally, improper handling of channel reconfiguration could result in memory leaks."], "name": "CVE-2026-31498", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31498\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31498\nhttps://lore.kernel.org/linux-cve-announce/2026042204-CVE-2026-31498-1aee@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96298f640104e4cd9a913a6e50b0b981829b94ff,9760b83cfd24b38caee663f429011a0dd6064fa9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96298f640104e4cd9a913a6e50b0b981829b94ff,de37e2655b7abc3f59254c6b72256840f39fc6d5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96298f640104e4cd9a913a6e50b0b981829b94ff,e7aab23b7df89a3d754a5f0a7d2237548b328bd0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96298f640104e4cd9a913a6e50b0b981829b94ff,52667c859fe33f70c2e711cb81bbd505d5eb8e75)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96298f640104e4cd9a913a6e50b0b981829b94ff,9a21a631ee034b1573dce14b572a24943dbfd7ae)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96298f640104e4cd9a913a6e50b0b981829b94ff,900e4db5385ec2cacd372345a80ab9c8e105b3a3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96298f640104e4cd9a913a6e50b0b981829b94ff,042e2cd4bb11e5313b19b87593616524949e4c52)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96298f640104e4cd9a913a6e50b0b981829b94ff,25f420a0d4cfd61d3d23ec4b9c56d9f443d91377)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "4ad03ff6f680681c5f78254e37c4c856fa953629"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b7d0ca715c1008acd2fc018f02a56fed88f78b75"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "799263eb37a4f7f6d39334046929c3bc92452a7f"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8828622fb9b4201eeb0870587052e3d834cfaf61"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b432ea85ab8472763870dd0f2c186130dd36d68c"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.253,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.203,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.168,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.131,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.80,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.21,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.11,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T15:33:01.751725+00:00", "value": {"mitigation_remediation": ["Apply the kernel patch that addresses the L2CAP ERTM re\u2011init and zero pdu_len issues.", "Reboot the system or reload the Bluetooth subsystem to load the updated kernel module.", "Restrict or disable Bluetooth L2CAP functionality from unknown or untrusted devices until the patch is in force."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service through memory exhaustion and infinite loop"}, "threat_synthesis": {"affected_systems": "This issue affects the Linux kernel itself, specifically the Bluetooth L2CAP subsystem in all kernel releases that include the affected code paths. The exact kernel versions are not enumerated in the supplied data, but any kernel with the L2CAP reconfiguration logic will be impacted. Since the CNA list lists Linux:Linux, users running any Linux kernel distribution with the stock Bluetooth stack should consider this vulnerability.", "description_and_impact": "The vulnerability originates from the Linux kernel\u2019s Bluetooth L2CAP implementation, where a reconfiguration request on an already connected channel re\u2011initializes ERTM data structures without freeing prior allocations, leading to memory leaks of all previously allocated resources. Additionally, a missing validation of the remote maximum packet size allows a zero value to propagate into the segmentation routine, causing an infinite loop that consumes all available memory. An attacker who can trigger repeated reconfiguration or provide malformed configuration values could exhaust system memory or cause the kernel to hang, resulting in denial of service.", "risk_and_exploitability": "The CVSS score is 7.0, and the EPSS score is < 1%, indicating moderate severity but a very low current exploitation probability. The vulnerability is listed in the kernel source as a regression fix but is not currently in the CISA KEV catalog. If an attacker can induce the kernel to process a configuration request with a zero remote MPS value, the infinite loop can be triggered, though practical exploitation would require some form of privileged or elevated Bluetooth interaction. The presence of a memory leak adds a secondary persistence risk. Administrators should not assume negligible impact; until the kernel is updated, the system could suffer a denial of service."}}}}, "created": "2026-04-22T17:30:22.455397+00:00", "updated": "2026-04-28T15:45:06.371977+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-322", "CWE-606", "CWE-772"]}