Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-31513
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-04-22 14:16:50 UTC
Updated2026-04-22 14:16:50 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req Syzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd() that is triggered by a malformed Enhanced Credit Based Connection Request. The vulnerability stems from l2cap_ecred_conn_req(). The function allocates a local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel IDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more than 5 SCIDs, the function calculates `rsp_len` based on this unvalidated `cmd_len` before checking if the number of SCIDs exceeds L2CAP_ECRED_MAX_CID. If the SCID count is too high, the function correctly jumps to the `response` label to reject the packet, but `rsp_len` retains the attacker's oversized value. Consequently, l2cap_send_cmd() is instructed to read past the end of the 18-byte `pdu` buffer, triggering a KASAN panic. Fix this by moving the assignment of `rsp_len` to after the `num_scid` boundary check. If the packet is rejected, `rsp_len` will safely remain 0, and the error response will only read the 8-byte base header from the stack.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 935f324e4b2461df2cf7f02b4195082b4304c708 c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc git Not specified
CNA Linux Linux affected e981a9392800ce2c5bca196a6ab2c55e9370efaa 5b35f8211a913cfe7ab9d54fa36a272d2059a588 git Not specified
CNA Linux Linux affected f3fdf2e7276a3edc5df55454275da20eac186970 a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b git Not specified
CNA Linux Linux affected c28d2bff70444a85b3b86aaf241ece9408c7858c 9d87cb22195b2c67405f5485d525190747ad5493 git Not specified
CNA Linux Linux affected 6.12.75 6.12.80 semver Not specified
CNA Linux Linux affected 6.18.16 6.18.21 semver Not specified
CNA Linux Linux affected 6.19.6 6.19.11 semver Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5b35f8211a913cfe7ab9d54fa36a272d2059a588 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9d87cb22195b2c67405f5485d525190747ad5493 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report