Stack-out-of-bounds read in Linux kernel Bluetooth component

CVE-2026-31513

What is CVE-2026-31513?

A vulnerability in the Linux kernel's Bluetooth protocol implementation allows attackers to exploit a stack-out-of-bounds read condition. This occurs within the function l2cap_ecred_conn_req() when improperly processed Enhanced Credit Based Connection Requests, specifically those containing more than five Source Channel IDs (SCIDs). The function calculates a response length based on unvalidated command length parameters, leading to potential reading beyond the allocated 18-byte stack buffer. This flaw can result in a KASAN panic, exposing the system to further risks. The issue has been addressed by repositioning the response length assignment to ensure it only updates after verifying the number of SCIDs, preventing overflow during error handling.

References