CVE-2026-31513

{"id": "CVE-2026-31513", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31513", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:10:31.040486Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "935f324e4b2461df2cf7f02b4195082b4304c708", "lessThan": "c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc", "versionType": "git"}, {"status": "affected", "version": "e981a9392800ce2c5bca196a6ab2c55e9370efaa", "lessThan": "5b35f8211a913cfe7ab9d54fa36a272d2059a588", "versionType": "git"}, {"status": "affected", "version": "f3fdf2e7276a3edc5df55454275da20eac186970", "lessThan": "a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b", "versionType": "git"}, {"status": "affected", "version": "c28d2bff70444a85b3b86aaf241ece9408c7858c", "lessThan": "9d87cb22195b2c67405f5485d525190747ad5493", "versionType": "git"}], "programFiles": ["net/bluetooth/l2cap_core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12.75", "lessThan": "6.12.80", "versionType": "semver"}, {"status": "affected", "version": "6.18.16", "lessThan": "6.18.21", "versionType": "semver"}, {"status": "affected", "version": "6.19.6", "lessThan": "6.19.11", "versionType": "semver"}], "programFiles": ["net/bluetooth/l2cap_core.c"], "defaultStatus": "unaffected"}]}], "published": "2026-04-22T14:16:50.673", "references": [{"url": "https://git.kernel.org/stable/c/5b35f8211a913cfe7ab9d54fa36a272d2059a588", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9d87cb22195b2c67405f5485d525190747ad5493", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req\n\nSyzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd()\nthat is triggered by a malformed Enhanced Credit Based Connection Request.\n\nThe vulnerability stems from l2cap_ecred_conn_req(). The function allocates\na local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel\nIDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more\nthan 5 SCIDs, the function calculates `rsp_len` based on this unvalidated\n`cmd_len` before checking if the number of SCIDs exceeds\nL2CAP_ECRED_MAX_CID.\n\nIf the SCID count is too high, the function correctly jumps to the\n`response` label to reject the packet, but `rsp_len` retains the\nattacker's oversized value. Consequently, l2cap_send_cmd() is instructed\nto read past the end of the 18-byte `pdu` buffer, triggering a\nKASAN panic.\n\nFix this by moving the assignment of `rsp_len` to after the `num_scid`\nboundary check. If the packet is rejected, `rsp_len` will safely\nremain 0, and the error response will only read the 8-byte base header\nfrom the stack."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: L2CAP: Correcci\u00f3n de lectura fuera de l\u00edmites de la pila en l2cap_ecred_conn_req\n\nSyzbot inform\u00f3 una lectura KASAN fuera de l\u00edmites de la pila en l2cap_build_cmd() que es activada por una solicitud de conexi\u00f3n basada en cr\u00e9dito mejorada malformada.\n\nLa vulnerabilidad se origina en l2cap_ecred_conn_req(). La funci\u00f3n asigna un b\u00fafer de pila local (\u2019pdu\u2019) dise\u00f1ado para contener un m\u00e1ximo de 5 ID de canal de origen (SCID), con un total de 18 bytes. Cuando un atacante env\u00eda una solicitud con m\u00e1s de 5 SCID, la funci\u00f3n calcula \u2019rsp_len\u2019 bas\u00e1ndose en este \u2019cmd_len\u2019 no validado antes de verificar si el n\u00famero de SCID excede L2CAP_ECRED_MAX_CID.\n\nSi el recuento de SCID es demasiado alto, la funci\u00f3n salta correctamente a la etiqueta \u2019response\u2019 para rechazar el paquete, pero \u2019rsp_len\u2019 retiene el valor sobredimensionado del atacante. En consecuencia, se le indica a l2cap_send_cmd() que lea m\u00e1s all\u00e1 del final del b\u00fafer \u2019pdu\u2019 de 18 bytes, lo que desencadena un p\u00e1nico KASAN.\n\nSolucione esto moviendo la asignaci\u00f3n de \u2019rsp_len\u2019 a despu\u00e9s de la verificaci\u00f3n de l\u00edmites de \u2019num_scid\u2019. Si el paquete es rechazado, \u2019rsp_len\u2019 permanecer\u00e1 de forma segura en 0, y la respuesta de error solo leer\u00e1 el encabezado base de 8 bytes de la pila."}], "lastModified": "2026-11-11T23:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E823EB64-1F92-40BB-891C-D94D00EDA086", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.12.75"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C57E63A-04BA-47E0-A942-789F7236A636", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.18.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BFE33C3-C605-4CC2-9F15-3494BA78E2C9", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.6"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}