CVE-2026-31393

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31393
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access l2cap_information_rsp() checks that cmd_len covers the fixed l2cap_info_rsp header (type + result, 4 bytes) but then reads rsp->data without verifying that the payload is present: - L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data), which reads 4 bytes past the header (needs cmd_len >= 8). - L2CAP_IT_FIXED_CHAN reads rsp->data[0], 1 byte past the header (needs cmd_len >= 5). A truncated L2CAP_INFO_RSP with result == L2CAP_IR_SUCCESS triggers an out-of-bounds read of adjacent skb data. Guard each data access with the required payload length check. If the payload is too short, skip the read and let the state machine complete with safe defaults (feat_mask and remote_fixed_chan remain zero from kzalloc), so the info timer cleanup and l2cap_conn_start() still run and the connection is not stalled.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/187e6fe939295be36063a1d91f8bebee04399a8c Patch
https://git.kernel.org/stable/c/3b646516cba2ebc4b51a72954903326e7c1e443f Patch
https://git.kernel.org/stable/c/5229e7d15771eac2b5886bfb1f976aea0c1eec14 Patch
https://git.kernel.org/stable/c/807bd1258453c4c83f6ae9dbc1e7b44860ff40d0 Patch
https://git.kernel.org/stable/c/9aeacde4da0f02d42fd968fd32f245828b230171 Patch
https://git.kernel.org/stable/c/db2872d054e467810078e2b9f440a5b326a601b2 Patch
https://git.kernel.org/stable/c/dd815e6e3918dc75a49aaabac36e4f024d675101 Patch
https://git.kernel.org/stable/c/e7ff754e339e3d5ce29aa9f95352d0186df8fbd9 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
History

24 Jul 2026, 22:10

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: Bluetooth: L2CAP: Validar la longitud de la carga útil de L2CAP_INFO_RSP antes del acceso l2cap_information_rsp() comprueba que cmd_len cubre la cabecera fija de l2cap_info_rsp (tipo + resultado, 4 bytes) pero luego lee rsp -> data sin verificar que la carga útil esté presente: - L2CAP_IT_FEAT_MASK llama a get_unaligned_le32(rsp -> data), que lee 4 bytes después de la cabecera (necesita cmd_len >= 8). - L2CAP_IT_FIXED_CHAN lee rsp -> data[0], 1 byte después de la cabecera (necesita cmd_len >= 5). Un L2CAP_INFO_RSP truncado con result == L2CAP_IR_SUCCESS desencadena una lectura fuera de límites de datos skb adyacentes. Proteger cada acceso a datos con la comprobación de longitud de carga útil requerida. Si la carga útil es demasiado corta, omitir la lectura y permitir que la máquina de estados se complete con valores predeterminados seguros (feat_mask y remote_fixed_chan permanecen en cero desde kzalloc), para que la limpieza del temporizador de información y l2cap_conn_start() sigan ejecutándose y la conexión no se estanque.

26 May 2026, 12:56

Type Values Removed Values Added
CWE CWE-125
References () https://git.kernel.org/stable/c/187e6fe939295be36063a1d91f8bebee04399a8c - () https://git.kernel.org/stable/c/187e6fe939295be36063a1d91f8bebee04399a8c - Patch
References () https://git.kernel.org/stable/c/3b646516cba2ebc4b51a72954903326e7c1e443f - () https://git.kernel.org/stable/c/3b646516cba2ebc4b51a72954903326e7c1e443f - Patch
References () https://git.kernel.org/stable/c/5229e7d15771eac2b5886bfb1f976aea0c1eec14 - () https://git.kernel.org/stable/c/5229e7d15771eac2b5886bfb1f976aea0c1eec14 - Patch
References () https://git.kernel.org/stable/c/807bd1258453c4c83f6ae9dbc1e7b44860ff40d0 - () https://git.kernel.org/stable/c/807bd1258453c4c83f6ae9dbc1e7b44860ff40d0 - Patch
References () https://git.kernel.org/stable/c/9aeacde4da0f02d42fd968fd32f245828b230171 - () https://git.kernel.org/stable/c/9aeacde4da0f02d42fd968fd32f245828b230171 - Patch
References () https://git.kernel.org/stable/c/db2872d054e467810078e2b9f440a5b326a601b2 - () https://git.kernel.org/stable/c/db2872d054e467810078e2b9f440a5b326a601b2 - Patch
References () https://git.kernel.org/stable/c/dd815e6e3918dc75a49aaabac36e4f024d675101 - () https://git.kernel.org/stable/c/dd815e6e3918dc75a49aaabac36e4f024d675101 - Patch
References () https://git.kernel.org/stable/c/e7ff754e339e3d5ce29aa9f95352d0186df8fbd9 - () https://git.kernel.org/stable/c/e7ff754e339e3d5ce29aa9f95352d0186df8fbd9 - Patch
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*

27 Apr 2026, 14:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1

18 Apr 2026, 09:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/187e6fe939295be36063a1d91f8bebee04399a8c -
  • () https://git.kernel.org/stable/c/5229e7d15771eac2b5886bfb1f976aea0c1eec14 -

03 Apr 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-03 16:16

Updated : 2026-07-24 22:10

NVD link : CVE-2026-31393

Mitre link : CVE-2026-31393

CVE.ORG link : CVE-2026-31393

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read