CVE-2026-31512 Details
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb. The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.
A vulnerability in the Linux kernel's Bluetooth implementation, specifically within the L2CAP (Logical Link Control and Adaptation Protocol) layer, has been addressed. The issue arose because the function 'l2cap_ecred_data_rcv()' read the SDU (Service Data Unit) length from the packet data without first checking if the packet contained the required minimum length. This oversight allowed the function to read past the end of the valid data, potentially leading to memory corruption. The vulnerability was present in several versions of the Linux kernel.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the kernel can be found in the official Linux kernel documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/3340be2bafdcc806f048273ea6d8e82a6597aa1b | kernel.org | Patch |
| https://git.kernel.org/stable/c/40c7f7eea2f4d9cb0b3e924254c8c9053372168f | kernel.org | Patch |
| https://git.kernel.org/stable/c/477ad4976072056c348937e94f24583321938df4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5ad981249be52f5e4e92e0e97b436b569071cb86 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8c96f3bd4ae0802db90630be8e9851827e9c9209 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c65bd945d1c08c3db756821b6bf9f1c4a77b29c6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cef09691cfb61f6c91cc27c3d69634f81c8ab949 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e47315b84d0eb188772c3ff5cf073cdbdefca6b4 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 3.14.1, < 5.10.253 >= 5.11, < 5.15.203 >= 5.16, < 6.1.168 >= 6.2, < 6.6.131 >= 6.7, < 6.12.80 >= 6.13, < 6.18.21 >= 6.19, < 6.19.11 3.14 - 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 7.0 rc7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | New CVE Received | kernel.org |