SB2026050273 - Stack-based buffer overflow in Linux kernel bluetooth

Description

This security bulletin contains information about 1 vulnerability.

1) Stack-based buffer overflow (CVE-ID: CVE-2026-31772)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in hci_le_big_create_sync when processing a crafted ISO socket configuration. A local user can bind an ISO socket with a large number of BIS entries and call listen() to cause a denial of service.

The issue is triggered when the number of BIS entries is between 18 and 31, leading to a stack out-of-bounds write in the HCI command sync worker.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/aba0aea354015794e8312dd7efe726967e58aefe
• https://git.kernel.org/stable/c/bc39a094730ce062fa034a529c93147c096cb488
• https://git.kernel.org/stable/c/eaf32002ca7b1ba51c9f140991fd9febe6de79f0
• https://git.kernel.org/stable/c/f5d446624345d309e7a4a1b27ea9f028d6a8c5d9