CVE-2026-31500

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31500", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.104Z", "datePublished": "2026-04-22T13:54:21.071Z", "dateUpdated": "2026-11-05T21:45:03.558Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-01T16:11:37.910Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock\n\nbtintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET\nand Intel exception-info retrieval) without holding\nhci_req_sync_lock(). This lets it race against\nhci_dev_do_close() -> btintel_shutdown_combined(), which also runs\n__hci_cmd_sync() under the same lock. When both paths manipulate\nhdev->req_status/req_rsp concurrently, the close path may free the\nresponse skb first, and the still-running hw_error path hits a\nslab-use-after-free in kfree_skb().\n\nWrap the whole recovery sequence in hci_req_sync_lock/unlock so it\nis serialized with every other synchronous HCI command issuer.\n\nBelow is the data race report and the kasan report:\n\n BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined\n\n read of hdev->req_rsp at net/bluetooth/hci_sync.c:199\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254\n hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030\n\n write/free by task ioctl/22580:\n btintel_shutdown_combined+0xd0/0x360\n drivers/bluetooth/btintel.c:3648\n hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246\n hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526\n\n BUG: KASAN: slab-use-after-free in\n sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202\n Read of size 4 at addr ffff888144a738dc\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btintel.c"], "versions": [{"version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "lessThan": "7e041d0aad1d4d43d921ace052e04f4e2cacaed3", "status": "affected", "versionType": "git"}, {"version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "lessThan": "5f84e845648dfa86e42de5487f1a774b42f0444d", "status": "affected", "versionType": "git"}, {"version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "lessThan": "e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5", "status": "affected", "versionType": "git"}, {"version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "lessThan": "66696648af477dc87859e5e4b607112f5f29d010", "status": "affected", "versionType": "git"}, {"version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "lessThan": "f7d84737663ad4a120d2d8ef1561a4df91282c2e", "status": "affected", "versionType": "git"}, {"version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "lessThan": "94d8e6fe5d0818e9300e514e095a200bd5ff93ae", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btintel.c"], "versions": [{"version": "4.3", "status": "affected"}, {"version": "0", "lessThan": "4.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.131", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.6.131"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3"}, {"url": "https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444d"}, {"url": "https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5"}, {"url": "https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010"}, {"url": "https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2e"}, {"url": "https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93ae"}], "title": "Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:16:40.314Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:35:57.538533Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:45:03.558Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:16:40.314Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:35:57.538533Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:35:58.947Z"}}], "cna": {"title": "Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "lessThan": "7e041d0aad1d4d43d921ace052e04f4e2cacaed3", "versionType": "git"}, {"status": "affected", "version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "lessThan": "5f84e845648dfa86e42de5487f1a774b42f0444d", "versionType": "git"}, {"status": "affected", "version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "lessThan": "e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5", "versionType": "git"}, {"status": "affected", "version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "lessThan": "66696648af477dc87859e5e4b607112f5f29d010", "versionType": "git"}, {"status": "affected", "version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "lessThan": "f7d84737663ad4a120d2d8ef1561a4df91282c2e", "versionType": "git"}, {"status": "affected", "version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "lessThan": "94d8e6fe5d0818e9300e514e095a200bd5ff93ae", "versionType": "git"}], "programFiles": ["drivers/bluetooth/btintel.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.3"}, {"status": "unaffected", "version": "0", "lessThan": "4.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.131", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.80", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/bluetooth/btintel.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3"}, {"url": "https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444d"}, {"url": "https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5"}, {"url": "https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010"}, {"url": "https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2e"}, {"url": "https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93ae"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock\n\nbtintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET\nand Intel exception-info retrieval) without holding\nhci_req_sync_lock(). This lets it race against\nhci_dev_do_close() -> btintel_shutdown_combined(), which also runs\n__hci_cmd_sync() under the same lock. When both paths manipulate\nhdev->req_status/req_rsp concurrently, the close path may free the\nresponse skb first, and the still-running hw_error path hits a\nslab-use-after-free in kfree_skb().\n\nWrap the whole recovery sequence in hci_req_sync_lock/unlock so it\nis serialized with every other synchronous HCI command issuer.\n\nBelow is the data race report and the kasan report:\n\n BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined\n\n read of hdev->req_rsp at net/bluetooth/hci_sync.c:199\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254\n hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030\n\n write/free by task ioctl/22580:\n btintel_shutdown_combined+0xd0/0x360\n drivers/bluetooth/btintel.c:3648\n hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246\n hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526\n\n BUG: KASAN: slab-use-after-free in\n sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202\n Read of size 4 at addr ffff888144a738dc\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.131", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.80", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "4.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-01T16:11:37.910Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31500", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:45:03.558Z", "dateReserved": "2026-03-09T15:48:24.104Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:54:21.071Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bluetooth/btintel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7e041d0aad1d4d43d921ace052e04f4e2cacaed3", "status": "affected", "version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "versionType": "git"}, {"lessThan": "5f84e845648dfa86e42de5487f1a774b42f0444d", "status": "affected", "version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "versionType": "git"}, {"lessThan": "e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5", "status": "affected", "version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "versionType": "git"}, {"lessThan": "66696648af477dc87859e5e4b607112f5f29d010", "status": "affected", "version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "versionType": "git"}, {"lessThan": "f7d84737663ad4a120d2d8ef1561a4df91282c2e", "status": "affected", "version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "versionType": "git"}, {"lessThan": "94d8e6fe5d0818e9300e514e095a200bd5ff93ae", "status": "affected", "version": "973bb97e5aee56edddaae3d5c96877101ad509c0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bluetooth/btintel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.3"}, {"lessThan": "4.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.131", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.80", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "13A272C2-FFCB-4269-8944-00DFA555EB6F", "versionEndExcluding": "6.6.131", "versionStartIncluding": "4.3.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.3:-:*:*:*:*:*:*", "matchCriteriaId": "5419A247-F671-44D6-9848-35264FDCD816", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock\n\nbtintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET\nand Intel exception-info retrieval) without holding\nhci_req_sync_lock(). This lets it race against\nhci_dev_do_close() -> btintel_shutdown_combined(), which also runs\n__hci_cmd_sync() under the same lock. When both paths manipulate\nhdev->req_status/req_rsp concurrently, the close path may free the\nresponse skb first, and the still-running hw_error path hits a\nslab-use-after-free in kfree_skb().\n\nWrap the whole recovery sequence in hci_req_sync_lock/unlock so it\nis serialized with every other synchronous HCI command issuer.\n\nBelow is the data race report and the kasan report:\n\n BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined\n\n read of hdev->req_rsp at net/bluetooth/hci_sync.c:199\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254\n hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030\n\n write/free by task ioctl/22580:\n btintel_shutdown_combined+0xd0/0x360\n drivers/bluetooth/btintel.c:3648\n hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246\n hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526\n\n BUG: KASAN: slab-use-after-free in\n sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202\n Read of size 4 at addr ffff888144a738dc\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: btintel: serializar btintel_hw_error() con hci_req_sync_lock\n\nbtintel_hw_error() emite dos llamadas a __hci_cmd_sync() (HCI_OP_RESET y recuperaci\u00f3n de informaci\u00f3n de excepci\u00f3n de Intel) sin mantener hci_req_sync_lock(). Esto permite que compita contra hci_dev_do_close() -> btintel_shutdown_combined(), que tambi\u00e9n ejecuta __hci_cmd_sync() bajo el mismo bloqueo. Cuando ambas rutas manipulan hdev -> req_status/req_rsp concurrentemente, la ruta de cierre puede liberar el skb de respuesta primero, y la ruta hw_error a\u00fan en ejecuci\u00f3n encuentra un uso despu\u00e9s de liberaci\u00f3n de slab en kfree_skb().\n\nEncapsular toda la secuencia de recuperaci\u00f3n en hci_req_sync_lock/unlock para que se serialice con cualquier otro emisor de comandos HCI s\u00edncronos.\n\nA continuaci\u00f3n se presenta el informe de condici\u00f3n de carrera y el informe kasan:\n\n ERROR: condici\u00f3n de carrera en __hci_cmd_sync_sk / btintel_shutdown_combined\n\n lectura de hdev -> req_rsp en net/bluetooth/hci_sync.c:199\n por la tarea kworker/u17:1/83:\n __hci_cmd_sync_sk+0x 12f2/0x 1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254\n hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030\n\n escritura/liberaci\u00f3n por la tarea ioctl/22580:\n btintel_shutdown_combined+0xd0/0x360\n drivers/bluetooth/btintel.c:3648\n hci_dev_close_sync+0x9ae/0x 2c10 net/bluetooth/hci_sync.c:5246\n hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526\n\n ERROR: KASAN: uso despu\u00e9s de liberaci\u00f3n de slab en\n sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202\n Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff888144a738dc\n por la tarea kworker/u17:1/83:\n __hci_cmd_sync_sk+0x 12f2/0x 1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260"}], "id": "CVE-2026-31500", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31500", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:35:57.538533Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:48.427", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93ae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2e"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock", "id": "2460662", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460662"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-820", "details": ["A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition exists in the Intel Bluetooth driver, where two functions can access the same memory concurrently without proper synchronization. This can lead to a use-after-free vulnerability, allowing a local attacker to potentially crash the system, resulting in a denial of service. In some cases, this type of vulnerability could also be exploited for arbitrary code execution."], "name": "CVE-2026-31500", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31500\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31500\nhttps://lore.kernel.org/linux-cve-announce/2026042204-CVE-2026-31500-c032@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[973bb97e5aee56edddaae3d5c96877101ad509c0,5f84e845648dfa86e42de5487f1a774b42f0444d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[973bb97e5aee56edddaae3d5c96877101ad509c0,e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[973bb97e5aee56edddaae3d5c96877101ad509c0,66696648af477dc87859e5e4b607112f5f29d010)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[973bb97e5aee56edddaae3d5c96877101ad509c0,f7d84737663ad4a120d2d8ef1561a4df91282c2e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[973bb97e5aee56edddaae3d5c96877101ad509c0,94d8e6fe5d0818e9300e514e095a200bd5ff93ae)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.131,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.80,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-29T03:06:57.365019+00:00", "value": {"mitigation_remediation": ["Upgrade the Linux kernel to a release that includes the hci_req_sync_lock patch for btintel.", "If an upgrade is not immediately possible, unload or blacklist the btintel module to disable the vulnerable Bluetooth interface.", "Disable or restrict the Bluetooth service to eliminate the attack surface while a kernel update is pending."], "summary": {"action": "Patch", "impact": "Kernel crash"}, "threat_synthesis": {"affected_systems": "All Linux kernel builds that include the btintel Bluetooth module and have not yet incorporated the hci_req_sync_lock serialization fix are vulnerable. The supplied CPE entries reference the generic Linux kernel, as well as specific releases such as 4.3 and the 7.0 release candidates 1 through 7, indicating that a broad swath of kernel versions may be affected.", "description_and_impact": "The Linux kernel\u2019s btintel Bluetooth driver can issue two synchronous HCI commands in btintel_hw_error() without holding the hci_req_sync_lock. When a shutdown routine also issues synchronous HCI commands under the same lock, concurrent manipulation of hdev->req_status and hdev->req_rsp can occur. The close path may free the response skb first, and the still-running hw_error path, which has not yet released the lock, then accesses that freed skb, resulting in a slab\u2011use\u2011after\u2011free during kfree_skb. This use\u2011after\u2011free causes a kernel crash and represents a denial\u2011of\u2011service flaw. Based on the description, it is inferred that an attacker would need to trigger the race condition through concurrent Bluetooth operations.", "risk_and_exploitability": "The CVSS score of 7.8 indicates a moderate to high severity. The EPSS score is below 1\u202f% and the vulnerability is not listed in CISA\u2019s KEV catalog, suggesting a low likelihood of active exploitation. Exploitation would require a local attacker to trigger the race condition by generating simultaneous HCI commands and a close operation against the Bluetooth stack, leading to a kernel crash and service interruption. The likely attack vector is a local race condition induced by concurrently issuing Bluetooth HCI commands while closing the adapter. The overall risk is moderate, and prompt patching is recommended."}}}}, "created": "2026-04-22T19:30:24.550280+00:00", "updated": "2026-04-29T03:15:45.991223+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}