CVE-2026-31393 - Vulnerability Details

- Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access

l2cap_information_rsp() checks that cmd_len covers the fixed
l2cap_info_rsp header (type + result, 4 bytes) but then reads
rsp->data without verifying that the payload is present:

- L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data), which reads
4 bytes past the header (needs cmd_len >= 8).

- L2CAP_IT_FIXED_CHAN reads rsp->data[0], 1 byte past the header
(needs cmd_len >= 5).

A truncated L2CAP_INFO_RSP with result == L2CAP_IR_SUCCESS triggers an
out-of-bounds read of adjacent skb data.

Guard each data access with the required payload length check. If the
payload is too short, skip the read and let the state machine complete
with safe defaults (feat_mask and remote_fixed_chan remain zero from
kzalloc), so the info timer cleanup and l2cap_conn_start() still run
and the connection is not stalled.

Published: 2026-04-03

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw exists in the Linux kernel Bluetooth subsystem. When a Bluetooth device sends a L2CAP_INFO_RSP packet, the kernel function l2cap_information_rsp checks only the fixed header portion of the packet but then reads beyond the header without verifying that the reported payload length is sufficient. This out‑of‑bounds read can expose adjacent kernel memory. The vulnerability does not provide code execution but can leak sensitive data, making it a high‑severity flaw with a CVSS score of 8.1.

Affected Systems

All Linux kernel releases prior to the application of the patch commit 3b646516cba2ebc4b51a72954903326e7c1e443f or the equivalent patch set are affected. The issue was discovered in the Linux:Linux vendor ecosystem, affecting the generic Linux kernel image. No specific downstream versions are listed, so any distribution kernel that has not yet applied the patch may remain vulnerable.

Risk and Exploitability

The exploitable payload requires an attacker with access to the Bluetooth interface to send a crafted L2CAP_INFO_RSP message. The exploit vector is likely remote over a Bluetooth channel, but local exploitation is also conceivable if the attacker can trigger the condition. The EPSS score of less than 1% and its absence from the CISA KEV catalog suggest a low current likelihood of exploitation, yet the impact warrants remediation. An attacker would gain information leakage rather than full control.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4e8402a3f884427f9233ba436459c158d1f2e114`	affected	< 187e6fe939295be36063a1d91f8bebee04399a8c
`4e8402a3f884427f9233ba436459c158d1f2e114`	affected	< 5229e7d15771eac2b5886bfb1f976aea0c1eec14
`4e8402a3f884427f9233ba436459c158d1f2e114`	affected	< 3b646516cba2ebc4b51a72954903326e7c1e443f
`4e8402a3f884427f9233ba436459c158d1f2e114`	affected	< 807bd1258453c4c83f6ae9dbc1e7b44860ff40d0
`4e8402a3f884427f9233ba436459c158d1f2e114`	affected	< 9aeacde4da0f02d42fd968fd32f245828b230171
`4e8402a3f884427f9233ba436459c158d1f2e114`	affected	< e7ff754e339e3d5ce29aa9f95352d0186df8fbd9
`4e8402a3f884427f9233ba436459c158d1f2e114`	affected	< db2872d054e467810078e2b9f440a5b326a601b2
`4e8402a3f884427f9233ba436459c158d1f2e114`	affected	< dd815e6e3918dc75a49aaabac36e4f024d675101

Linux

affected

Version	Status	Constraints
`2.6.24`	affected	—
`0`	unaffected	< 2.6.24
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.20`	unaffected	≤ 6.18.*
`6.19.10`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4e8402a3f884427f9233ba436459c158d1f2e114,3b646516cba2ebc4b51a72954903326e7c1e443f)`	affected	code_commit	—
`[4e8402a3f884427f9233ba436459c158d1f2e114,807bd1258453c4c83f6ae9dbc1e7b44860ff40d0)`	affected	code_commit	—
`[4e8402a3f884427f9233ba436459c158d1f2e114,9aeacde4da0f02d42fd968fd32f245828b230171)`	affected	code_commit	—
`[4e8402a3f884427f9233ba436459c158d1f2e114,e7ff754e339e3d5ce29aa9f95352d0186df8fbd9)`	affected	code_commit	—
`[4e8402a3f884427f9233ba436459c158d1f2e114,db2872d054e467810078e2b9f440a5b326a601b2)`	affected	code_commit	—
`[4e8402a3f884427f9233ba436459c158d1f2e114,dd815e6e3918dc75a49aaabac36e4f024d675101)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.24`	affected	semver	—
`[0,2.6.24)`	unaffected	semver	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.20,6.19.0)`	unaffected	semver	—
`[6.19.10,6.20.0)`	unaffected	semver	—
`[7.0-rc5,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patch commit 3b646516cba2ebc4b51a72954903326e7c1e443f or later.
If immediate kernel upgrade is not feasible, disable L2CAP on affected interfaces via sysfs or configuration to stop L2CAP traffic.
Alternatively, block all L2CAP traffic on the interface using a firewall rule such as nftables or iptables until a patch is applied.

Generated by OpenCVE AI on April 28, 2026 at 08:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00035.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/187e6fe939295be36063a1d91f8bebee04399a8c
https://git.kernel.org/stable/c/3b646516cba2ebc4b51a72954903326e7c1e443f
https://git.kernel.org/stable/c/5229e7d15771eac2b5886bfb1f976aea0c1eec14
https://git.kernel.org/stable/c/807bd1258453c4c83f6ae9dbc1e7b44860ff40d0
https://git.kernel.org/stable/c/9aeacde4da0f02d42fd968fd32f245828b230171
https://git.kernel.org/stable/c/db2872d054e467810078e2b9f440a5b326a601b2
https://git.kernel.org/stable/c/dd815e6e3918dc75a49aaabac36e4f024d675101
https://git.kernel.org/stable/c/e7ff754e339e3d5ce29aa9f95352d0186df8fbd9
https://lore.kernel.org/linux-cve-announce/2026040325-CVE-2026-31393-5e12@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31393
https://www.cve.org/CVERecord?id=CVE-2026-31393

History

Mon, 27 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}`

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/187e6fe939295be36063a1d91f8bebee04399a8c https://git.kernel.org/stable/c/5229e7d15771eac2b5886bfb1f976aea0c1eec14

Tue, 07 Apr 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-788

Sat, 04 Apr 2026 01:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-130
References		https://lore.kernel.org/linux-cve-announce/2026040325-CVE-2026-31393-5e12@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31393 https://www.cve.org/CVERecord?id=CVE-2026-31393
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 03 Apr 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-788

Fri, 03 Apr 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access l2cap_information_rsp() checks that cmd_len covers the fixed l2cap_info_rsp header (type + result, 4 bytes) but then reads rsp->data without verifying that the payload is present: - L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data), which reads 4 bytes past the header (needs cmd_len >= 8). - L2CAP_IT_FIXED_CHAN reads rsp->data[0], 1 byte past the header (needs cmd_len >= 5). A truncated L2CAP_INFO_RSP with result == L2CAP_IR_SUCCESS triggers an out-of-bounds read of adjacent skb data. Guard each data access with the required payload length check. If the payload is too short, skip the read and let the state machine complete with safe defaults (feat_mask and remote_fixed_chan remain zero from kzalloc), so the info timer cleanup and l2cap_conn_start() still run and the connection is not stalled.
Title		Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3b646516cba2ebc4b51a72954903326e7c1e443f https://git.kernel.org/stable/c/807bd1258453c4c83f6ae9dbc1e7b44860ff40d0 https://git.kernel.org/stable/c/9aeacde4da0f02d42fd968fd32f245828b230171 https://git.kernel.org/stable/c/db2872d054e467810078e2b9f440a5b326a601b2 https://git.kernel.org/stable/c/dd815e6e3918dc75a49aaabac36e4f024d675101 https://git.kernel.org/stable/c/e7ff754e339e3d5ce29aa9f95352d0186df8fbd9

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-03T15:15:58.142Z

Updated: 2026-04-27T14:02:43.957Z

Reserved: 2026-03-09T15:48:24.085Z

Link: CVE-2026-31393

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-04-03T16:16:37.420

Modified: 2026-04-27T14:16:35.473

Link: CVE-2026-31393

Redhat

Severity : Moderate

Publid Date: 2026-04-03T00:00:00Z

Links: CVE-2026-31393 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-28T09:00:06Z

Weaknesses

CWE-130

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object