CVE-2026-31772 Linux CVE debrief

Who should care

Linux system administrators, Bluetooth developers, and security teams responsible for Linux systems with Bluetooth functionality should assess exposure and prioritize patching. This includes teams managing Linux systems with high exposure to untrusted devices, as well as developers and administrators responsible for applying patches and verifying system security.

Why it matters

CVE-2026-31772 is a high-severity stack buffer overflow vulnerability in the Linux kernel's Bluetooth hci_sync component. Linux system administrators and security teams should assess exposure, prioritize patching, and monitor for potential exploitation attempts. The vulnerability allows local attackers to potentially corrupt stack memory and elevate privileges.

• Potential stack memory corruption and arbitrary code execution
• Elevation of privileges for local attackers
• Denial of service through stack memory corruption
• Increased risk for systems with high exposure to untrusted devices

Technical summary

The hci_le_big_create_sync function in the Linux kernel's Bluetooth hci_sync component uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17) BIS entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31) entries. When conn->num_bis is between 18 and 31, the memcpy that copies conn->bis into cp->bis writes up to 14 bytes past the stack buffer, corrupting adjacent stack memory.

Defensive priority

High-priority assessment and patching recommended for Linux systems with Bluetooth functionality, especially those with high exposure to untrusted devices.

Recommended defensive actions

• Assess Linux system exposure and prioritize patching for Bluetooth-enabled systems
• Verify and apply patches from Linux vendors for affected versions
• Monitor system logs for potential exploitation attempts
• Consider compensating controls for systems with high exposure to untrusted devices
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the stack buffer overflow vulnerability in the Linux kernel's Bluetooth hci_sync component. The NVD entry is currently not provided. To verify and assess exposure, defenders should review the official advisory, check system logs for potential exploitation attempts, and consider compensating controls for systems with high exposure to untrusted devices. The vulnerability's source-confidence limits and review context indicate a high-severity issue requiring prompt attention.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.