PT-2026-34405 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-31500

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the Bluetooth component where the btintel hw error() function issues synchronous HCI commands without holding the hci req sync lock lock. This allows it to race against btintel shutdown combined(), which also executes synchronous commands under the same lock. Concurrent manipulation of hdev->req status and hdev->req rsp can lead to a situation where the close path frees the response socket buffer (skb) first, resulting in a slab-use-after-free in kfree skb() when the hardware error path continues execution.

Recommendations Wrap the recovery sequence in hci req sync lock and hci req sync unlock to ensure it is serialized with all other synchronous HCI command issuers.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-31500

ECHO-66EB-2411-DC51

Affected Products

Linux Kernel

References · 16

• https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31500 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31500 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31500 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31500 · Vendor Advisory
• https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444d · Patch
• https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31500 · Vendor Advisory
• https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93ae · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31500 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31500 · Vendor Advisory
• https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2e · Patch
• https://git.kernel.org/linus/94d8e6fe5d0818e9300e514e095a200bd5ff93ae · Note
• https://twitter.com/vuldb/status/2046973341928759765 · Twitter Post
• https://docs.bell-sw.com/security/cves/CVE-2026-31500 · Note