{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86c8d07a64d553c41e213b52650020010f9ef23e",
              "status": "affected",
              "version": "2f20216c1d6fe17c1a224f658be0dc6fab2269c7",
              "versionType": "git"
            },
            {
              "lessThan": "2b2bf47cd75518c36fa2d41380e4a40641cc89cd",
              "status": "affected",
              "version": "2f20216c1d6fe17c1a224f658be0dc6fab2269c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the HCI event header but before hci_event_func()\nenforces the per-event minimum payload length from hci_ev_table.\nThis means a short HCI event frame can reach bacpy() before any bounds\ncheck runs.\n\nRather than duplicating skb parsing and per-event length checks inside\nhci_store_wake_reason(), move wake-address storage into the individual\nevent handlers after their existing event-length validation has\nsucceeded. Convert hci_store_wake_reason() into a small helper that only\nstores an already-validated bdaddr while the caller holds hci_dev_lock().\nUse the same helper after hci_event_func() with a NULL address to\npreserve the existing unexpected-wake fallback semantics when no\nvalidated event handler records a wake address.\n\nAnnotate the helper with __must_hold(\u0026hdev-\u003elock) and add\nlockdep_assert_held(\u0026hdev-\u003elock) so future call paths keep the lock\ncontract explicit.\n\nCall the helper from hci_conn_request_evt(), hci_conn_complete_evt(),\nhci_sync_conn_complete_evt(), le_conn_complete_evt(),\nhci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),\nhci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and\nhci_le_past_received_evt()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable parser is in Bluetooth HCI event handling, reached from controller events generated by nearby Bluetooth activity such as connection or advertising wake events. Bluetooth attacks require radio adjacency rather than IP network reachability.\nAC:L - No race is required; a short HCI event reaches wake-reason parsing before the normal per-event length checks. The suspended/wake-reason state is a normal Bluetooth remote-wake deployment condition, so under the higher-severity rule this is low complexity.\nPR:N - An adjacent Bluetooth peer does not need privileges on the vulnerable host, and affected events can occur before any Bluetooth authentication or pairing decision in the host stack. Local HCI injection paths may require privileges, but the adjacent radio scenario requires none.\nUI:N - No victim action is required once Bluetooth remote wake/scanning is enabled and the system is in the affected state. The attacker only needs to deliver the triggering Bluetooth activity/event.\nS:U - The impact remains within the same kernel/host security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an out-of-bounds kernel heap read from an skb before validation, copied into wake-address state that is later reported through management resume events. Although each copy is small, repeated malformed wake events and multiple event layouts make kernel memory disclosure plausible, so the higher severity option is selected.\nI:N - The vulnerable operation copies out-of-bounds source bytes into intended hci_dev wake-reason fields, but does not provide an out-of-bounds write or control over unrelated kernel memory. I found no path from this state corruption to arbitrary modification or code execution.\nA:H - The malformed short event can drive invalid kernel memory reads before bounds checks; depending on allocator layout or hardening, this can cause an oops/panic. As a kernel fault from attacker-supplied malformed Bluetooth input is plausible, availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:03.550Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/86c8d07a64d553c41e213b52650020010f9ef23e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b2bf47cd75518c36fa2d41380e4a40641cc89cd"
        }
      ],
      "title": "Bluetooth: hci_event: move wake reason storage into validated event handlers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31771",
    "datePublished": "2026-05-01T14:14:59.918Z",
    "dateReserved": "2026-03-09T15:48:24.140Z",
    "dateUpdated": "2026-08-05T12:25:03.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}