CVE-2026-31513 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Bluetooth L2CAP component users, and Linux distribution maintainers should assess exposure and apply the patch to prevent potential exploitation.

Why it matters

The CVE-2026-31513 vulnerability in the Linux kernel's Bluetooth L2CAP component can lead to a stack-out-of-bounds read, potentially causing a KASAN panic. Defenders should prioritize patch application and monitoring of Bluetooth L2CAP traffic.

• Verify patch application to prevent stack-out-of-bounds reads
• Monitor Bluetooth L2CAP traffic for potential exploitation attempts
• Update Linux kernel versions to include the fix

Technical summary

The vulnerability exists in the Linux kernel's Bluetooth L2CAP component, specifically in the `l2cap_ecred_conn_req` function. A malformed Enhanced Credit Based Connection Request can trigger a stack-out-of-bounds read, leading to a KASAN panic. The fix involves moving the assignment of `rsp_len` to after the `num_scid` boundary check. This ensures that `rsp_len` remains 0 if the packet is rejected, preventing a stack-out-of-bounds read. The vulnerability was reported by Syzbot and resolved by this patch. Linux kernel developers should review and apply the patch to prevent potential exploitation.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch to ensure the vulnerability is resolved
• Verify that the Linux kernel version is updated to include the fix
• Monitor Bluetooth L2CAP traffic for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability was reported by Syzbot and resolved by moving the assignment of `rsp_len` to after the `num_scid` boundary check. The fix ensures that `rsp_len` remains 0 if the packet is rejected, preventing a stack-out-of-bounds read.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.