CVE-2026-31512

Vulnerability

In the Linux kernel's Bluetooth subsystem, the function l2cap_ecred_data_rcv() in the L2CAP layer reads the SDU length field from the incoming skb data using get_unaligned_le16() without first verifying that the skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this results in reading past the valid data in the skb, leading to an out-of-bounds read [1].

Exploitation

An attacker with the ability to send crafted Bluetooth L2CAP packets to a vulnerable system can trigger this issue. The attack requires no special privileges beyond the ability to communicate over Bluetooth. The Enhanced Credit Based Flow Control (ECRED) path is used for connection-oriented data, and a malformed packet with a short length can cause the kernel to read memory beyond the packet boundary.

Impact

Successful exploitation could lead to information disclosure, as the out-of-bounds read may leak sensitive kernel memory. The CVSS v3 score of 5.5 (Medium) reflects the potential for confidentiality impact, though the attack complexity is high and requires local access or close proximity.

Mitigation

The fix adds a pskb_may_pull() check before reading the SDU length, consistent with the existing validation in the ERTM reassembly path. The patch has been applied to the Linux kernel stable branches as seen in commits [1], [2], [3], and [4]. Users should update to the latest kernel version containing this fix.