GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-31513 (GCVE-0-2026-31513)

Vulnerability from cvelistv5 – Published: 2026-04-22 13:54 – Updated: 2026-08-05 12:23
VLAI
Title
Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req Syzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd() that is triggered by a malformed Enhanced Credit Based Connection Request. The vulnerability stems from l2cap_ecred_conn_req(). The function allocates a local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel IDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more than 5 SCIDs, the function calculates `rsp_len` based on this unvalidated `cmd_len` before checking if the number of SCIDs exceeds L2CAP_ECRED_MAX_CID. If the SCID count is too high, the function correctly jumps to the `response` label to reject the packet, but `rsp_len` retains the attacker's oversized value. Consequently, l2cap_send_cmd() is instructed to read past the end of the 18-byte `pdu` buffer, triggering a KASAN panic. Fix this by moving the assignment of `rsp_len` to after the `num_scid` boundary check. If the packet is rejected, `rsp_len` will safely remain 0, and the error response will only read the 8-byte base header from the stack.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 935f324e4b2461df2cf7f02b4195082b4304c708 , < c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc (git)
Affected: e981a9392800ce2c5bca196a6ab2c55e9370efaa , < 5b35f8211a913cfe7ab9d54fa36a272d2059a588 (git)
Affected: f3fdf2e7276a3edc5df55454275da20eac186970 , < a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b (git)
Affected: c28d2bff70444a85b3b86aaf241ece9408c7858c , < 9d87cb22195b2c67405f5485d525190747ad5493 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12.75 , < 6.12.80 (semver)
Affected: 6.18.16 , < 6.18.21 (semver)
Affected: 6.19.6 , < 6.19.11 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc",
              "status": "affected",
              "version": "935f324e4b2461df2cf7f02b4195082b4304c708",
              "versionType": "git"
            },
            {
              "lessThan": "5b35f8211a913cfe7ab9d54fa36a272d2059a588",
              "status": "affected",
              "version": "e981a9392800ce2c5bca196a6ab2c55e9370efaa",
              "versionType": "git"
            },
            {
              "lessThan": "a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b",
              "status": "affected",
              "version": "f3fdf2e7276a3edc5df55454275da20eac186970",
              "versionType": "git"
            },
            {
              "lessThan": "9d87cb22195b2c67405f5485d525190747ad5493",
              "status": "affected",
              "version": "c28d2bff70444a85b3b86aaf241ece9408c7858c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.12.80",
              "status": "affected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.21",
              "status": "affected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.19.11",
              "status": "affected",
              "version": "6.19.6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "6.12.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "6.18.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "6.19.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req\n\nSyzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd()\nthat is triggered by a malformed Enhanced Credit Based Connection Request.\n\nThe vulnerability stems from l2cap_ecred_conn_req(). The function allocates\na local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel\nIDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more\nthan 5 SCIDs, the function calculates `rsp_len` based on this unvalidated\n`cmd_len` before checking if the number of SCIDs exceeds\nL2CAP_ECRED_MAX_CID.\n\nIf the SCID count is too high, the function correctly jumps to the\n`response` label to reject the packet, but `rsp_len` retains the\nattacker\u0027s oversized value. Consequently, l2cap_send_cmd() is instructed\nto read past the end of the 18-byte `pdu` buffer, triggering a\nKASAN panic.\n\nFix this by moving the assignment of `rsp_len` to after the `num_scid`\nboundary check. If the packet is rejected, `rsp_len` will safely\nremain 0, and the error response will only read the 8-byte base header\nfrom the stack."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable code is reached by a Bluetooth LE L2CAP signaling packet from a nearby Bluetooth peer, so exploitation requires adjacent radio proximity rather than internet routing or local code execution.\nAC:L - The attacker only needs to send a malformed Enhanced Credit Based Connection Request with more than 5 SCIDs; the bad length is used deterministically before the bounds check.\nPR:N - The vulnerable path is reached before PSM lookup and before `smp_sufficient_security()`, so no pairing, authentication, service authorization, or local privilege is required.\nUI:N - Once the target is reachable over Bluetooth LE, the malformed signaling request is processed by the kernel without requiring a victim user action.\nS:U - The impact is within the kernel Bluetooth stack on the same host security authority; this is not a cross-VM, IOMMU, or sandbox boundary escape by itself.\nC:H - The oversized response length causes `l2cap_send_cmd()` to copy beyond an 18-byte stack buffer into an outbound L2CAP response, exposing attacker-sized kernel stack contents rather than a strictly bounded few bytes.\nI:N - The bug is an out-of-bounds read used to build a response packet; it does not provide an out-of-bounds write or direct modification of kernel data.\nA:H - The same malformed packet triggers a demonstrated KASAN stack-out-of-bounds panic, and a sufficiently large kernel stack read can reasonably crash the kernel even outside KASAN builds."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:12.375Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b35f8211a913cfe7ab9d54fa36a272d2059a588"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d87cb22195b2c67405f5485d525190747ad5493"
        }
      ],
      "title": "Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31513",
    "datePublished": "2026-04-22T13:54:30.835Z",
    "dateReserved": "2026-03-09T15:48:24.107Z",
    "dateUpdated": "2026-08-05T12:23:12.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31513",
      "date": "2026-09-19",
      "epss": "0.00252",
      "percentile": "0.17009"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/l2cap_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc",
                    "status": "affected",
                    "version": "935f324e4b2461df2cf7f02b4195082b4304c708",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5b35f8211a913cfe7ab9d54fa36a272d2059a588",
                    "status": "affected",
                    "version": "e981a9392800ce2c5bca196a6ab2c55e9370efaa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b",
                    "status": "affected",
                    "version": "f3fdf2e7276a3edc5df55454275da20eac186970",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9d87cb22195b2c67405f5485d525190747ad5493",
                    "status": "affected",
                    "version": "c28d2bff70444a85b3b86aaf241ece9408c7858c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/l2cap_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6.12.80",
                    "status": "affected",
                    "version": "6.12.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.21",
                    "status": "affected",
                    "version": "6.18.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.19.11",
                    "status": "affected",
                    "version": "6.19.6",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E823EB64-1F92-40BB-891C-D94D00EDA086",
                    "versionEndExcluding": "6.12.80",
                    "versionStartIncluding": "6.12.75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6C57E63A-04BA-47E0-A942-789F7236A636",
                    "versionEndExcluding": "6.18.21",
                    "versionStartIncluding": "6.18.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1BFE33C3-C605-4CC2-9F15-3494BA78E2C9",
                    "versionEndExcluding": "6.19.11",
                    "versionStartIncluding": "6.19.6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req\n\nSyzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd()\nthat is triggered by a malformed Enhanced Credit Based Connection Request.\n\nThe vulnerability stems from l2cap_ecred_conn_req(). The function allocates\na local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel\nIDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more\nthan 5 SCIDs, the function calculates `rsp_len` based on this unvalidated\n`cmd_len` before checking if the number of SCIDs exceeds\nL2CAP_ECRED_MAX_CID.\n\nIf the SCID count is too high, the function correctly jumps to the\n`response` label to reject the packet, but `rsp_len` retains the\nattacker\u0027s oversized value. Consequently, l2cap_send_cmd() is instructed\nto read past the end of the 18-byte `pdu` buffer, triggering a\nKASAN panic.\n\nFix this by moving the assignment of `rsp_len` to after the `num_scid`\nboundary check. If the packet is rejected, `rsp_len` will safely\nremain 0, and the error response will only read the 8-byte base header\nfrom the stack."
          }
        ],
        "id": "CVE-2026-31513",
        "lastModified": "2026-06-17T10:33:53.437",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-04-22T14:16:50.673",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5b35f8211a913cfe7ab9d54fa36a272d2059a588"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9d87cb22195b2c67405f5485d525190747ad5493"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T17:14:21+00:00",
      "cve": "CVE-2026-31513",
      "id": "CVE-2026-31513",
      "initial_release_date": "2026-04-22T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31513.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-22T00:07:31Z",
      "cve": "CVE-2026-31513",
      "id": "CVE-2026-31513",
      "initial_release_date": "2026-04-23T01:25:07Z",
      "product_status:known_not_affected": "259",
      "product_status:recommended": "98",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31513",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31513.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.