CVE-2026-31497

Vulnerability

CVE-2026-31497 is an out-of-bounds read vulnerability in the btusb driver of the Linux kernel's Bluetooth subsystem. The function btusb_work() maps the number of active SCO (Synchronous Connection-Oriented) links to USB alternate settings by indexing a fixed-size lookup table alts[] with data->sco_num - 1. The value data->sco_num is derived from hci_conn_num() and is not clamped to the table's size (3 entries). If more than three SCO links are active, the index exceeds the array bounds, causing an out-of-bounds read. [1][2]

Exploitation

An attacker would need local access and the ability to influence the number of active SCO links beyond three, for example by establishing multiple Bluetooth connections. The attack does not require authentication beyond local system access. The driver subsequently selects an incorrect (potentially non-existent) alternate setting from memory after the array, which can lead to unexpected USB behavior or a kernel crash. [3][4]

Impact

The out-of-bounds read can expose adjacent kernel memory or cause a denial-of-service (system crash) due to reading invalid USB alternate setting descriptors. The CVSS score 5.5 (Medium) reflects the requirement for local access and the likelihood of a crash or information disclosure.

Mitigation

The fix is merged into the mainline Linux kernel and stable branches. It clamps the lookup index to the last valid table entry when sco_num exceeds the array size, ensuring the highest supported alternate setting is selected correctly. Users should update their kernel to include the commits referenced in [1]–[4] or apply the backported patches.