CVE-2026-31771 - Vulnerability Details

- Bluetooth: hci_event: move wake reason storage into validated event handlers

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: move wake reason storage into validated event handlers

hci_store_wake_reason() is called from hci_event_packet() immediately
after stripping the HCI event header but before hci_event_func()
enforces the per-event minimum payload length from hci_ev_table.
This means a short HCI event frame can reach bacpy() before any bounds
check runs.

Rather than duplicating skb parsing and per-event length checks inside
hci_store_wake_reason(), move wake-address storage into the individual
event handlers after their existing event-length validation has
succeeded. Convert hci_store_wake_reason() into a small helper that only
stores an already-validated bdaddr while the caller holds hci_dev_lock().
Use the same helper after hci_event_func() with a NULL address to
preserve the existing unexpected-wake fallback semantics when no
validated event handler records a wake address.

Annotate the helper with __must_hold(&hdev->lock) and add
lockdep_assert_held(&hdev->lock) so future call paths keep the lock
contract explicit.

Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(),
hci_sync_conn_complete_evt(), le_conn_complete_evt(),
hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),
hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and
hci_le_past_received_evt().

Published: 2026-05-01

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A short Bluetooth HCI event frame can reach bacpy() before the event’s payload length is validated, allowing a buffer copy without size check (CWE‑120) and an out‑of‑bounds read (CWE‑125), which can corrupt memory, trigger a kernel panic, or potentially enable execution of arbitrary code.

Affected Systems

All Linux kernel builds that contain the legacy Bluetooth HCI event handling code are vulnerable until the commit series that moves wake‑reason storage into validated event handlers is applied. The affected releases are those that do not yet incorporate the changes identified by commits 2b2bf47cd75518c36fa2d41380e4a40641cc89cd and 86c8d07a64d553c41e213b52650020010f9ef23e, so any distribution kernel lacking these patches remains at risk.

Risk and Exploitability

The CVSS score of 8.1 denotes high severity, while the EPSS score of < 1 % indicates a low likelihood of exploitation at present and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker must inject a crafted HCI event packet via a remote Bluetooth connection to trigger the overflow. If successful, the kernel could crash or be compromised, leading to denial of service or privilege escalation. Although exploitation is currently not widespread, the absence of a bounds check represents a significant risk to kernel integrity.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2f20216c1d6fe17c1a224f658be0dc6fab2269c7`	affected	< fbea63d0d301edd4a42f4390b49b8519d78b802d
`2f20216c1d6fe17c1a224f658be0dc6fab2269c7`	affected	< 1e4b738dd0d0f7b237686167706badad9d30649c
`2f20216c1d6fe17c1a224f658be0dc6fab2269c7`	affected	< ac7889b0fe441e4ef892c40b1d002e91f93fa4ae
`2f20216c1d6fe17c1a224f658be0dc6fab2269c7`	affected	< dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2
`2f20216c1d6fe17c1a224f658be0dc6fab2269c7`	affected	< 86c8d07a64d553c41e213b52650020010f9ef23e
`2f20216c1d6fe17c1a224f658be0dc6fab2269c7`	affected	< 2b2bf47cd75518c36fa2d41380e4a40641cc89cd

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.114`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[2f20216c1d6fe17c1a224f658be0dc6fab2269c7,86c8d07a64d553c41e213b52650020010f9ef23e)`	affected	code_commit	—
`[2f20216c1d6fe17c1a224f658be0dc6fab2269c7,2b2bf47cd75518c36fa2d41380e4a40641cc89cd)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.10`	affected	semver	—
`[0,5.10)`	unaffected	semver	—
`[6.19.12,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that moves wake‑reason storage into validated event handlers, as implemented in the referenced commits, to eliminate the unchecked buffer copy.
If an immediate kernel upgrade is not possible, disable the Bluetooth (hci) driver to prevent execution of the vulnerable code.
Restrict Bluetooth connectivity to trusted devices, for example by configuring ACLs or firewall rules that block unknown HCI traffic, thereby reducing the exposure to malformed packets.

Generated by OpenCVE AI on October 23, 2026 at 08:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0032.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/1e4b738dd0d0f7b237686167706badad9d30649c
https://git.kernel.org/stable/c/2b2bf47cd75518c36fa2d41380e4a40641cc89cd
https://git.kernel.org/stable/c/86c8d07a64d553c41e213b52650020010f9ef23e
https://git.kernel.org/stable/c/ac7889b0fe441e4ef892c40b1d002e91f93fa4ae
https://git.kernel.org/stable/c/dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2
https://git.kernel.org/stable/c/fbea63d0d301edd4a42f4390b49b8519d78b802d
https://lore.kernel.org/linux-cve-announce/2026050148-CVE-2026-31771-9cd0@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31771
https://www.cve.org/CVERecord?id=CVE-2026-31771

History

Fri, 30 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/fbea63d0d301edd4a42f4390b49b8519d78b802d

Wed, 21 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1e4b738dd0d0f7b237686167706badad9d30649c https://git.kernel.org/stable/c/ac7889b0fe441e4ef892c40b1d002e91f93fa4ae

Mon, 19 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Fri, 16 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 15 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2

Mon, 11 May 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

Sun, 03 May 2026 06:30:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}`

Sat, 02 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120
References		https://lore.kernel.org/linux-cve-announce/2026050148-CVE-2026-31771-9cd0@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31771 https://www.cve.org/CVERecord?id=CVE-2026-31771
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 01 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: move wake reason storage into validated event handlers hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs. Rather than duplicating skb parsing and per-event length checks inside hci_store_wake_reason(), move wake-address storage into the individual event handlers after their existing event-length validation has succeeded. Convert hci_store_wake_reason() into a small helper that only stores an already-validated bdaddr while the caller holds hci_dev_lock(). Use the same helper after hci_event_func() with a NULL address to preserve the existing unexpected-wake fallback semantics when no validated event handler records a wake address. Annotate the helper with __must_hold(&hdev->lock) and add lockdep_assert_held(&hdev->lock) so future call paths keep the lock contract explicit. Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and hci_le_past_received_evt().
Title		Bluetooth: hci_event: move wake reason storage into validated event handlers
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2b2bf47cd75518c36fa2d41380e4a40641cc89cd https://git.kernel.org/stable/c/86c8d07a64d553c41e213b52650020010f9ef23e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-01T14:14:59.918Z

Updated: 2026-10-30T12:24:42.601Z

Reserved: 2026-03-09T15:48:24.140Z

Link: CVE-2026-31771

Vulnrichment

Updated: 2026-10-16T15:13:05.006Z

NVD

Status : Modified

Published: 2026-05-01T15:16:40.337

Modified: 2026-10-30T13:18:43.817

Link: CVE-2026-31771

Redhat

Severity : Moderate

Publid Date: 2026-05-01T00:00:00Z

Links: CVE-2026-31771 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T09:00:15Z

Weaknesses

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-125
Out-of-bounds Read
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object