SB2026040648 - Out-of-bounds read in Linux kernel bluetooth
Published: April 6, 2026
Security Bulletin ID
SB2026040648
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Out-of-bounds read (CVE-ID: CVE-2026-31393)
The vulnerability allows a remote attacker to disclose adjacent memory contents.
The vulnerability exists due to an out-of-bounds read in l2cap_information_rsp() when processing a truncated L2CAP_INFO_RSP packet with a successful result. A remote attacker can send a specially crafted Bluetooth L2CAP response to disclose adjacent memory contents.
The issue occurs because the code reads response payload data beyond the validated fixed header length for L2CAP_IT_FEAT_MASK and L2CAP_IT_FIXED_CHAN cases.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/3b646516cba2ebc4b51a72954903326e7c1e443f
- https://git.kernel.org/stable/c/807bd1258453c4c83f6ae9dbc1e7b44860ff40d0
- https://git.kernel.org/stable/c/9aeacde4da0f02d42fd968fd32f245828b230171
- https://git.kernel.org/stable/c/db2872d054e467810078e2b9f440a5b326a601b2
- https://git.kernel.org/stable/c/dd815e6e3918dc75a49aaabac36e4f024d675101
- https://git.kernel.org/stable/c/e7ff754e339e3d5ce29aa9f95352d0186df8fbd9