CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers
Bluetooth: hcievent: move wake reason storage into validated event handlers
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1035.38 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 7.0.0-1006.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.12 - Compensating control
Move wake-address storage from hci_event_packet() into the validated event handlers: hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and hci_le_past_received_evt(). Convert hci_store_wake_reason() to store only an already-validated bdaddr while the caller holds hci_dev_lock(), annotate it with __must_hold(&hdev->lock), and add lockdep_assert_held(&hdev->lock). Call the helper after hci_event_func() with a NULL address to preserve the unexpected-wake fallback.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31771?
CVE-2026-31771 has been classified as a medium severity vulnerability.
How do I fix CVE-2026-31771?
To address CVE-2026-31771, you should update your Linux kernel to the latest stable version that includes the patch.
What impact does CVE-2026-31771 have on Bluetooth functionality?
CVE-2026-31771 could potentially lead to improper handling of Bluetooth wake events, affecting reliability.
Is CVE-2026-31771 exploitable remotely?
CVE-2026-31771 is not considered remotely exploitable under typical scenarios.
What Linux kernel versions are affected by CVE-2026-31771?
CVE-2026-31771 affects various versions of the Linux kernel prior to the release of the patch.