CVE-2026-31513

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31513", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.107Z", "datePublished": "2026-04-22T13:54:30.835Z", "dateUpdated": "2026-10-19T18:45:54.652Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:12.375Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req\n\nSyzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd()\nthat is triggered by a malformed Enhanced Credit Based Connection Request.\n\nThe vulnerability stems from l2cap_ecred_conn_req(). The function allocates\na local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel\nIDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more\nthan 5 SCIDs, the function calculates `rsp_len` based on this unvalidated\n`cmd_len` before checking if the number of SCIDs exceeds\nL2CAP_ECRED_MAX_CID.\n\nIf the SCID count is too high, the function correctly jumps to the\n`response` label to reject the packet, but `rsp_len` retains the\nattacker's oversized value. Consequently, l2cap_send_cmd() is instructed\nto read past the end of the 18-byte `pdu` buffer, triggering a\nKASAN panic.\n\nFix this by moving the assignment of `rsp_len` to after the `num_scid`\nboundary check. If the packet is rejected, `rsp_len` will safely\nremain 0, and the error response will only read the 8-byte base header\nfrom the stack."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable code is reached by a Bluetooth LE L2CAP signaling packet from a nearby Bluetooth peer, so exploitation requires adjacent radio proximity rather than internet routing or local code execution.\nAC:L - The attacker only needs to send a malformed Enhanced Credit Based Connection Request with more than 5 SCIDs; the bad length is used deterministically before the bounds check.\nPR:N - The vulnerable path is reached before PSM lookup and before `smp_sufficient_security()`, so no pairing, authentication, service authorization, or local privilege is required.\nUI:N - Once the target is reachable over Bluetooth LE, the malformed signaling request is processed by the kernel without requiring a victim user action.\nS:U - The impact is within the kernel Bluetooth stack on the same host security authority; this is not a cross-VM, IOMMU, or sandbox boundary escape by itself.\nC:H - The oversized response length causes `l2cap_send_cmd()` to copy beyond an 18-byte stack buffer into an outbound L2CAP response, exposing attacker-sized kernel stack contents rather than a strictly bounded few bytes.\nI:N - The bug is an out-of-bounds read used to build a response packet; it does not provide an out-of-bounds write or direct modification of kernel data.\nA:H - The same malformed packet triggers a demonstrated KASAN stack-out-of-bounds panic, and a sufficiently large kernel stack read can reasonably crash the kernel even outside KASAN builds."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/l2cap_core.c"], "versions": [{"version": "935f324e4b2461df2cf7f02b4195082b4304c708", "lessThan": "c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc", "status": "affected", "versionType": "git"}, {"version": "e981a9392800ce2c5bca196a6ab2c55e9370efaa", "lessThan": "5b35f8211a913cfe7ab9d54fa36a272d2059a588", "status": "affected", "versionType": "git"}, {"version": "f3fdf2e7276a3edc5df55454275da20eac186970", "lessThan": "a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b", "status": "affected", "versionType": "git"}, {"version": "c28d2bff70444a85b3b86aaf241ece9408c7858c", "lessThan": "9d87cb22195b2c67405f5485d525190747ad5493", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/l2cap_core.c"], "versions": [{"version": "6.12.75", "lessThan": "6.12.80", "status": "affected", "versionType": "semver"}, {"version": "6.18.16", "lessThan": "6.18.21", "status": "affected", "versionType": "semver"}, {"version": "6.19.6", "lessThan": "6.19.11", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.75", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.16", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.6", "versionEndExcluding": "6.19.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc"}, {"url": "https://git.kernel.org/stable/c/5b35f8211a913cfe7ab9d54fa36a272d2059a588"}, {"url": "https://git.kernel.org/stable/c/a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b"}, {"url": "https://git.kernel.org/stable/c/9d87cb22195b2c67405f5485d525190747ad5493"}], "title": "Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31513", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:10:31.040486Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:45:54.652Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31513", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:10:31.040486Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:10:31.846Z"}}], "cna": {"title": "Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable code is reached by a Bluetooth LE L2CAP signaling packet from a nearby Bluetooth peer, so exploitation requires adjacent radio proximity rather than internet routing or local code execution.\nAC:L - The attacker only needs to send a malformed Enhanced Credit Based Connection Request with more than 5 SCIDs; the bad length is used deterministically before the bounds check.\nPR:N - The vulnerable path is reached before PSM lookup and before `smp_sufficient_security()`, so no pairing, authentication, service authorization, or local privilege is required.\nUI:N - Once the target is reachable over Bluetooth LE, the malformed signaling request is processed by the kernel without requiring a victim user action.\nS:U - The impact is within the kernel Bluetooth stack on the same host security authority; this is not a cross-VM, IOMMU, or sandbox boundary escape by itself.\nC:H - The oversized response length causes `l2cap_send_cmd()` to copy beyond an 18-byte stack buffer into an outbound L2CAP response, exposing attacker-sized kernel stack contents rather than a strictly bounded few bytes.\nI:N - The bug is an out-of-bounds read used to build a response packet; it does not provide an out-of-bounds write or direct modification of kernel data.\nA:H - The same malformed packet triggers a demonstrated KASAN stack-out-of-bounds panic, and a sufficiently large kernel stack read can reasonably crash the kernel even outside KASAN builds."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "935f324e4b2461df2cf7f02b4195082b4304c708", "lessThan": "c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc", "versionType": "git"}, {"status": "affected", "version": "e981a9392800ce2c5bca196a6ab2c55e9370efaa", "lessThan": "5b35f8211a913cfe7ab9d54fa36a272d2059a588", "versionType": "git"}, {"status": "affected", "version": "f3fdf2e7276a3edc5df55454275da20eac186970", "lessThan": "a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b", "versionType": "git"}, {"status": "affected", "version": "c28d2bff70444a85b3b86aaf241ece9408c7858c", "lessThan": "9d87cb22195b2c67405f5485d525190747ad5493", "versionType": "git"}], "programFiles": ["net/bluetooth/l2cap_core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12.75", "lessThan": "6.12.80", "versionType": "semver"}, {"status": "affected", "version": "6.18.16", "lessThan": "6.18.21", "versionType": "semver"}, {"status": "affected", "version": "6.19.6", "lessThan": "6.19.11", "versionType": "semver"}], "programFiles": ["net/bluetooth/l2cap_core.c"], "defaultStatus": "unaffected"}], "references": [{"url": "https://git.kernel.org/stable/c/c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc"}, {"url": "https://git.kernel.org/stable/c/5b35f8211a913cfe7ab9d54fa36a272d2059a588"}, {"url": "https://git.kernel.org/stable/c/a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b"}, {"url": "https://git.kernel.org/stable/c/9d87cb22195b2c67405f5485d525190747ad5493"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req\n\nSyzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd()\nthat is triggered by a malformed Enhanced Credit Based Connection Request.\n\nThe vulnerability stems from l2cap_ecred_conn_req(). The function allocates\na local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel\nIDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more\nthan 5 SCIDs, the function calculates `rsp_len` based on this unvalidated\n`cmd_len` before checking if the number of SCIDs exceeds\nL2CAP_ECRED_MAX_CID.\n\nIf the SCID count is too high, the function correctly jumps to the\n`response` label to reject the packet, but `rsp_len` retains the\nattacker's oversized value. Consequently, l2cap_send_cmd() is instructed\nto read past the end of the 18-byte `pdu` buffer, triggering a\nKASAN panic.\n\nFix this by moving the assignment of `rsp_len` to after the `num_scid`\nboundary check. If the packet is rejected, `rsp_len` will safely\nremain 0, and the error response will only read the 8-byte base header\nfrom the stack."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.12.75"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.18.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:12.375Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31513", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:45:54.652Z", "dateReserved": "2026-03-09T15:48:24.107Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:54:30.835Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/l2cap_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc", "status": "affected", "version": "935f324e4b2461df2cf7f02b4195082b4304c708", "versionType": "git"}, {"lessThan": "5b35f8211a913cfe7ab9d54fa36a272d2059a588", "status": "affected", "version": "e981a9392800ce2c5bca196a6ab2c55e9370efaa", "versionType": "git"}, {"lessThan": "a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b", "status": "affected", "version": "f3fdf2e7276a3edc5df55454275da20eac186970", "versionType": "git"}, {"lessThan": "9d87cb22195b2c67405f5485d525190747ad5493", "status": "affected", "version": "c28d2bff70444a85b3b86aaf241ece9408c7858c", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/l2cap_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.12.80", "status": "affected", "version": "6.12.75", "versionType": "semver"}, {"lessThan": "6.18.21", "status": "affected", "version": "6.18.16", "versionType": "semver"}, {"lessThan": "6.19.11", "status": "affected", "version": "6.19.6", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E823EB64-1F92-40BB-891C-D94D00EDA086", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.12.75", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C57E63A-04BA-47E0-A942-789F7236A636", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.18.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BFE33C3-C605-4CC2-9F15-3494BA78E2C9", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req\n\nSyzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd()\nthat is triggered by a malformed Enhanced Credit Based Connection Request.\n\nThe vulnerability stems from l2cap_ecred_conn_req(). The function allocates\na local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel\nIDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more\nthan 5 SCIDs, the function calculates `rsp_len` based on this unvalidated\n`cmd_len` before checking if the number of SCIDs exceeds\nL2CAP_ECRED_MAX_CID.\n\nIf the SCID count is too high, the function correctly jumps to the\n`response` label to reject the packet, but `rsp_len` retains the\nattacker's oversized value. Consequently, l2cap_send_cmd() is instructed\nto read past the end of the 18-byte `pdu` buffer, triggering a\nKASAN panic.\n\nFix this by moving the assignment of `rsp_len` to after the `num_scid`\nboundary check. If the packet is rejected, `rsp_len` will safely\nremain 0, and the error response will only read the 8-byte base header\nfrom the stack."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: L2CAP: Correcci\u00f3n de lectura fuera de l\u00edmites de la pila en l2cap_ecred_conn_req\n\nSyzbot inform\u00f3 una lectura KASAN fuera de l\u00edmites de la pila en l2cap_build_cmd() que es activada por una solicitud de conexi\u00f3n basada en cr\u00e9dito mejorada malformada.\n\nLa vulnerabilidad se origina en l2cap_ecred_conn_req(). La funci\u00f3n asigna un b\u00fafer de pila local (\u2019pdu\u2019) dise\u00f1ado para contener un m\u00e1ximo de 5 ID de canal de origen (SCID), con un total de 18 bytes. Cuando un atacante env\u00eda una solicitud con m\u00e1s de 5 SCID, la funci\u00f3n calcula \u2019rsp_len\u2019 bas\u00e1ndose en este \u2019cmd_len\u2019 no validado antes de verificar si el n\u00famero de SCID excede L2CAP_ECRED_MAX_CID.\n\nSi el recuento de SCID es demasiado alto, la funci\u00f3n salta correctamente a la etiqueta \u2019response\u2019 para rechazar el paquete, pero \u2019rsp_len\u2019 retiene el valor sobredimensionado del atacante. En consecuencia, se le indica a l2cap_send_cmd() que lea m\u00e1s all\u00e1 del final del b\u00fafer \u2019pdu\u2019 de 18 bytes, lo que desencadena un p\u00e1nico KASAN.\n\nSolucione esto moviendo la asignaci\u00f3n de \u2019rsp_len\u2019 a despu\u00e9s de la verificaci\u00f3n de l\u00edmites de \u2019num_scid\u2019. Si el paquete es rechazado, \u2019rsp_len\u2019 permanecer\u00e1 de forma segura en 0, y la respuesta de error solo leer\u00e1 el encabezado base de 8 bytes de la pila."}], "id": "CVE-2026-31513", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31513", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:10:31.040486Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:50.673", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5b35f8211a913cfe7ab9d54fa36a272d2059a588"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9d87cb22195b2c67405f5485d525190747ad5493"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req", "id": "2460677", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460677"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component. A remote attacker can send a specially crafted Enhanced Credit Based Connection Request with an excessive number of Source Channel IDs (SCIDs). This can cause a stack-out-of-bounds read when processing the malformed request, leading to a kernel panic and a Denial of Service (DoS) on the affected system."], "name": "CVE-2026-31513", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31513\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31513\nhttps://lore.kernel.org/linux-cve-announce/2026042209-CVE-2026-31513-a32a@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[935f324e4b2461df2cf7f02b4195082b4304c708,c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e981a9392800ce2c5bca196a6ab2c55e9370efaa,5b35f8211a913cfe7ab9d54fa36a272d2059a588)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f3fdf2e7276a3edc5df55454275da20eac186970,a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c28d2bff70444a85b3b86aaf241ece9408c7858c,9d87cb22195b2c67405f5485d525190747ad5493)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.75,6.12.80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.16,6.18.21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.19.6,6.19.11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T23:59:39.844988+00:00", "value": {"mitigation_remediation": ["Apply a kernel update that includes the latest l2cap_ecred_conn_req fix.", "Rebuild and install any Bluetooth modules to ensure they are linked with the patched kernel.", "If a patch cannot be applied immediately, disable the Bluetooth service or block L2CAP traffic on the network to prevent malformed requests from reaching the host."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Linux kernel\u2019s Bluetooth L2CAP implementation. All kernel releases containing the original l2cap_ecred_conn_req code are potentially impacted until the patch that moves rsp_len assignment past the boundary check is deployed.", "description_and_impact": "A malformed Enhanced Credit Based Connection Request can cause the Linux kernel Bluetooth L2CAP stack to read past a 18\u2011byte stack buffer. The resulting out\u2011of\u2011bounds read triggers a KASAN panic, causing the kernel to crash. While this does not provide code execution, it can bring the system down entirely, leading to a denial of service.", "risk_and_exploitability": "The exploit requires an attacker to send a specially crafted Bluetooth packet that requests more than five Source Channel IDs. The attack vector is inferred to be over the Bluetooth interface, allowing remote or local actors to trigger the crash. The vulnerability is not listed in CISA KEV, has an EPSS score of <1%, and a CVSS score of 8.1. Nevertheless, the vulnerability can be triggered by remote devices in proximity, potentially making it feasible for attackers to cause service disruption on affected hosts."}}}}, "created": "2026-04-22T18:45:24.010521+00:00", "updated": "2026-04-29T00:00:13.856587+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}