CVE-2026-31772: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcisync: fix stack buffer overflow in hcilebigcreatesync
hcilebigcreatesync() uses DEFINEFLEX to allocate a struct hcicplebigcreatesync on the stack with room for 0x11 (17) BIS entries. However, conn->numbis can hold up to HCIMAXISOBIS (31) entries — validated against ISOMAXNUMBIS (0x1f) in the caller hciconnbigcreatesync(). When conn->numbis is between 18 and 31, the memcpy that copies conn->bis into cp->bis writes up to 14 bytes past the stack buffer, corrupting adjacent stack memory.
This is trivially reproducible: binding an ISO socket with bcnumbis = ISOMAXNUMBIS (31) and calling listen() will eventually trigger hcilebigcreatesync() from the HCI command sync worker, causing a KASAN-detectable stack-out-of-bounds write:
BUG: KASAN: stack-out-of-bounds in hcilebigcreatesync+0x256/0x3b0 Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71
Fix this by changing the DEFINEFLEX count from the incorrect 0x11 to HCIMAXISOBIS, which matches the maximum number of BIS entries that conn->bis can actually carry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the stack buffer overflow by changing the DEFINE_FLEX count from the incorrect 0x11 to HCI_MAX_ISO_BIS (so it matches the maximum number of BIS entries conn->num_bis can hold up to 31).
Linux kernel Bluetooth (hci_le_big_create_sync / hci_sync) DEFINE_FLEX count for struct hci_cp_le_big_create_sync = HCI_MAX_ISO_BIS - Compensating control
For affected kernels/hosts, consider isolating or limiting exposure of ISO sockets that can trigger hci_le_big_create_sync (e.g., avoid setting up ISO sockets with conn->num_bis between 18 and 31 until the fix is applied).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31772?
CVE-2026-31772 has been classified as a high severity vulnerability due to its potential to cause stack buffer overflow.
Who is affected by CVE-2026-31772?
CVE-2026-31772 affects users of the Linux kernel with Bluetooth functionality.
How do I fix CVE-2026-31772?
The fix for CVE-2026-31772 involves updating to the latest version of the Linux kernel that resolves this buffer overflow issue.
What is the nature of the vulnerability in CVE-2026-31772?
CVE-2026-31772 is a stack buffer overflow vulnerability in the hci_le_big_create_sync function of the Linux kernel.
Is CVE-2026-31772 exploitable?
Yes, CVE-2026-31772 is exploitable, which can lead to denial of service or code execution if successfully attacked.