CVE-2026-31497: Bluetooth: btusb: clamp SCO altsetting table indices
Bluetooth: btusb: clamp SCO altsetting table indices
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In btusb_work(), clamp the SCO alternate-setting table index to the last available entry before indexing alts[], so values of data->sco_num beyond the three-entry table select the highest supported alternate setting without reading past alts[].
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
Which systems are exposed?
Systems using the Linux kernel btusb driver are affected when handling SCO traffic with transparent voice settings. The issue involves more than three active SCO links causing the driver to index beyond its three-entry alternate-setting table.
What is the impact if exploitation succeeds?
The stated impact is availability only, with no confidentiality or integrity impact listed. The vulnerability can result in a denial of service.
What should be done if patching cannot happen immediately?
The provided data identifies a patch as available. No alternative mitigation or configuration workaround is provided.