SB20260424204 - Stack-based buffer overflow in Linux kernel bluetooth

Description

This security bulletin contains information about 1 vulnerability.

1) Stack-based buffer overflow (CVE-ID: CVE-2026-31513)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer over-read in l2cap_ecred_conn_req when handling a malformed enhanced credit based connection request. A remote attacker can send a specially crafted connection request with more than 5 source channel ids to cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5b35f8211a913cfe7ab9d54fa36a272d2059a588
• https://git.kernel.org/stable/c/9d87cb22195b2c67405f5485d525190747ad5493
• https://git.kernel.org/stable/c/a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b
• https://git.kernel.org/stable/c/c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc