PT-2026-34418 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-31513

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stack-out-of-bounds read exists in the Bluetooth L2CAP component. The function l2cap ecred conn req() allocates a local stack buffer pdu to hold up to 5 Source Channel IDs (SCIDs). When a malformed Enhanced Credit Based Connection Request containing more than 5 SCIDs is processed, the function calculates the rsp len variable based on an unvalidated cmd len before verifying if the SCID count exceeds L2CAP ECRED MAX CID. Although the packet is eventually rejected, rsp len retains the oversized value, causing l2cap send cmd() to read beyond the 18-byte pdu buffer, which leads to a KASAN panic. KASAN (Kernel Address Sanitizer) is a dynamic memory error detector for the Linux kernel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31513

Affected Products

Linux Kernel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-31513 · Security Note
• https://git.kernel.org/stable/c/a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b · Note
• https://git.kernel.org/stable/c/9d87cb22195b2c67405f5485d525190747ad5493 · Note
• https://twitter.com/VulmonFeeds/status/2047060822967390633 · Twitter Post
• https://git.kernel.org/stable/c/5b35f8211a913cfe7ab9d54fa36a272d2059a588 · Note
• https://twitter.com/CVEnew/status/2046979959193817569 · Twitter Post
• https://git.kernel.org/stable/c/c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc · Note