CVE-2026-31771 (GCVE-0-2026-31771)

Vulnerability from cvelistv5 – Published: 2026-05-01 14:14 – Updated: 2026-08-05 12:25
VLAI
Title
Bluetooth: hci_event: move wake reason storage into validated event handlers
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: move wake reason storage into validated event handlers hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs. Rather than duplicating skb parsing and per-event length checks inside hci_store_wake_reason(), move wake-address storage into the individual event handlers after their existing event-length validation has succeeded. Convert hci_store_wake_reason() into a small helper that only stores an already-validated bdaddr while the caller holds hci_dev_lock(). Use the same helper after hci_event_func() with a NULL address to preserve the existing unexpected-wake fallback semantics when no validated event handler records a wake address. Annotate the helper with __must_hold(&hdev->lock) and add lockdep_assert_held(&hdev->lock) so future call paths keep the lock contract explicit. Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and hci_le_past_received_evt().
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 , < 86c8d07a64d553c41e213b52650020010f9ef23e (git)
Affected: 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 , < 2b2bf47cd75518c36fa2d41380e4a40641cc89cd (git)
Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 6.19.12 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86c8d07a64d553c41e213b52650020010f9ef23e",
              "status": "affected",
              "version": "2f20216c1d6fe17c1a224f658be0dc6fab2269c7",
              "versionType": "git"
            },
            {
              "lessThan": "2b2bf47cd75518c36fa2d41380e4a40641cc89cd",
              "status": "affected",
              "version": "2f20216c1d6fe17c1a224f658be0dc6fab2269c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the HCI event header but before hci_event_func()\nenforces the per-event minimum payload length from hci_ev_table.\nThis means a short HCI event frame can reach bacpy() before any bounds\ncheck runs.\n\nRather than duplicating skb parsing and per-event length checks inside\nhci_store_wake_reason(), move wake-address storage into the individual\nevent handlers after their existing event-length validation has\nsucceeded. Convert hci_store_wake_reason() into a small helper that only\nstores an already-validated bdaddr while the caller holds hci_dev_lock().\nUse the same helper after hci_event_func() with a NULL address to\npreserve the existing unexpected-wake fallback semantics when no\nvalidated event handler records a wake address.\n\nAnnotate the helper with __must_hold(\u0026hdev-\u003elock) and add\nlockdep_assert_held(\u0026hdev-\u003elock) so future call paths keep the lock\ncontract explicit.\n\nCall the helper from hci_conn_request_evt(), hci_conn_complete_evt(),\nhci_sync_conn_complete_evt(), le_conn_complete_evt(),\nhci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),\nhci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and\nhci_le_past_received_evt()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable parser is in Bluetooth HCI event handling, reached from controller events generated by nearby Bluetooth activity such as connection or advertising wake events. Bluetooth attacks require radio adjacency rather than IP network reachability.\nAC:L - No race is required; a short HCI event reaches wake-reason parsing before the normal per-event length checks. The suspended/wake-reason state is a normal Bluetooth remote-wake deployment condition, so under the higher-severity rule this is low complexity.\nPR:N - An adjacent Bluetooth peer does not need privileges on the vulnerable host, and affected events can occur before any Bluetooth authentication or pairing decision in the host stack. Local HCI injection paths may require privileges, but the adjacent radio scenario requires none.\nUI:N - No victim action is required once Bluetooth remote wake/scanning is enabled and the system is in the affected state. The attacker only needs to deliver the triggering Bluetooth activity/event.\nS:U - The impact remains within the same kernel/host security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an out-of-bounds kernel heap read from an skb before validation, copied into wake-address state that is later reported through management resume events. Although each copy is small, repeated malformed wake events and multiple event layouts make kernel memory disclosure plausible, so the higher severity option is selected.\nI:N - The vulnerable operation copies out-of-bounds source bytes into intended hci_dev wake-reason fields, but does not provide an out-of-bounds write or control over unrelated kernel memory. I found no path from this state corruption to arbitrary modification or code execution.\nA:H - The malformed short event can drive invalid kernel memory reads before bounds checks; depending on allocator layout or hardening, this can cause an oops/panic. As a kernel fault from attacker-supplied malformed Bluetooth input is plausible, availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:03.550Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/86c8d07a64d553c41e213b52650020010f9ef23e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b2bf47cd75518c36fa2d41380e4a40641cc89cd"
        }
      ],
      "title": "Bluetooth: hci_event: move wake reason storage into validated event handlers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31771",
    "datePublished": "2026-05-01T14:14:59.918Z",
    "dateReserved": "2026-03-09T15:48:24.140Z",
    "dateUpdated": "2026-08-05T12:25:03.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31771",
      "date": "2026-08-10",
      "epss": "0.00205",
      "percentile": "0.10601"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:41:43.000Z",
      "cve": "CVE-2026-31771",
      "id": "msrc_CVE-2026-31771",
      "initial_release_date": "2026-05-02T01:02:53.000Z",
      "product_status:known_affected": "9",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: hci_event: move wake reason storage into validated event handlers",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31771.json",
      "version": "11"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31771\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-01T15:16:40.337\",\"lastModified\":\"2026-06-17T10:34:26.000\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: hci_event: move wake reason storage into validated event handlers\\n\\nhci_store_wake_reason() is called from hci_event_packet() immediately\\nafter stripping the HCI event header but before hci_event_func()\\nenforces the per-event minimum payload length from hci_ev_table.\\nThis means a short HCI event frame can reach bacpy() before any bounds\\ncheck runs.\\n\\nRather than duplicating skb parsing and per-event length checks inside\\nhci_store_wake_reason(), move wake-address storage into the individual\\nevent handlers after their existing event-length validation has\\nsucceeded. Convert hci_store_wake_reason() into a small helper that only\\nstores an already-validated bdaddr while the caller holds hci_dev_lock().\\nUse the same helper after hci_event_func() with a NULL address to\\npreserve the existing unexpected-wake fallback semantics when no\\nvalidated event handler records a wake address.\\n\\nAnnotate the helper with __must_hold(\u0026hdev-\u003elock) and add\\nlockdep_assert_held(\u0026hdev-\u003elock) so future call paths keep the lock\\ncontract explicit.\\n\\nCall the helper from hci_conn_request_evt(), hci_conn_complete_evt(),\\nhci_sync_conn_complete_evt(), le_conn_complete_evt(),\\nhci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),\\nhci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and\\nhci_le_past_received_evt().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/hci_event.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2f20216c1d6fe17c1a224f658be0dc6fab2269c7\",\"lessThan\":\"86c8d07a64d553c41e213b52650020010f9ef23e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f20216c1d6fe17c1a224f658be0dc6fab2269c7\",\"lessThan\":\"2b2bf47cd75518c36fa2d41380e4a40641cc89cd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/hci_event.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.12\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"6.19.12\",\"matchCriteriaId\":\"5C6630F4-82C7-43EE-A9AC-FF59BBAEEDD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2b2bf47cd75518c36fa2d41380e4a40641cc89cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/86c8d07a64d553c41e213b52650020010f9ef23e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T12:48:36+00:00",
      "cve": "CVE-2026-31771",
      "id": "CVE-2026-31771",
      "initial_release_date": "2026-05-01T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci_event: move wake reason storage into validated event handlers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31771.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-28T17:18:46Z",
      "cve": "CVE-2026-31771",
      "id": "CVE-2026-31771",
      "initial_release_date": "2026-05-06T01:42:48Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "411",
      "product_status:known_not_affected": "93",
      "product_status:recommended": "486",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31771",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31771.json",
      "version": "24"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.