CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2capecreddatarcv()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In l2cap_ecred_data_rcv(), validate that the skb contains at least L2CAP_SDULEN_SIZE (2) bytes before reading the SDU length; apply the same pskb_may_pull() validation used by the ERTM reassembly path.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31512?
CVE-2026-31512 is classified as a medium severity vulnerability.
How do I fix CVE-2026-31512?
To fix CVE-2026-31512, update the Linux kernel to the latest stable version that includes the patch.
What are the potential impacts of CVE-2026-31512?
CVE-2026-31512 could allow an attacker to exploit the Bluetooth L2CAP signaling channel and potentially disrupt Bluetooth services.
Which versions of the Linux kernel are affected by CVE-2026-31512?
CVE-2026-31512 affects specific versions of the Linux kernel prior to the implementation of the security patch.
Is CVE-2026-31512 associated with a specific Bluetooth component?
Yes, CVE-2026-31512 is associated with the L2CAP layer in the Bluetooth stack of the Linux kernel.