Bluetooth Vulnerability in Linux Kernel Affecting ERTM Resources

CVE-2026-31498

What is CVE-2026-31498?

A vulnerability exists in the Linux kernel's Bluetooth implementation, specifically in the L2CAP layer. The issue arises from the mismanagement of resources during the re-initialization of ERTM channels, leading to memory leaks. This occurs when reconfiguration requests are processed without freeing previously allocated resources. Additionally, a lack of validation for the minimum value of the remote maximum payload size can result in a zero-length packet, causing an infinite loop that exhausts system memory. Proper safeguards and code modifications are essential to mitigate these risks and enhance system stability.

References