PT-2026-30176 · Linux · Linux Kernel

Published 2026-04-03 · Updated 2026-05-22 · CVE-2026-31393

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the Bluetooth L2CAP implementation. Specifically, the l2cap information rsp() function does not adequately validate the length of the L2CAP INFO RSP payload before accessing it, potentially leading to out-of-bounds reads. This occurs when a truncated L2CAP INFO RSP message with a success result is received. The function l2cap information rsp() is vulnerable. The vulnerable parameters include rsp->data. Specifically, get unaligned le32(rsp->data) and rsp->data[0] are accessed without proper bounds checking.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-31393

ECHO-C4C1-8755-0A86

OESA-2026-1946

OESA-2026-1947

OESA-2026-1948

OESA-2026-2416

OESA-2026-2419

Affected Products

Linux Kernel

References · 71

• https://git.kernel.org/stable/c/3b646516cba2ebc4b51a72954903326e7c1e443f · Patch
• https://git.kernel.org/stable/c/e7ff754e339e3d5ce29aa9f95352d0186df8fbd9 · Patch
• https://git.kernel.org/stable/c/187e6fe939295be36063a1d91f8bebee04399a8c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23389 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68185 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23269 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-31393 · Vendor Advisory
• https://git.kernel.org/stable/c/dd815e6e3918dc75a49aaabac36e4f024d675101 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-40324 · Security Note
• https://git.kernel.org/stable/c/5229e7d15771eac2b5886bfb1f976aea0c1eec14 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-46333 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31447 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31393 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31393 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23441 · Security Note