CVE-2026-31497

Bluetooth: btusb: clamp SCO altsetting table indices

State: Published
Severity: Not scored
Published: Apr 22, 2026
Updated: May 11, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: clamp SCO altsetting table indices

btusb_work() maps the number of active SCO links to USB alternate settings through a three-entry lookup table when CVSD traffic uses transparent voice settings. The lookup currently indexes alts[] with data->sco_num - 1 without first constraining sco_num to the number of available table entries.

While the table only defines alternate settings for up to three SCO links, data->sco_num comes from hci_conn_num() and is used directly. Cap the lookup to the last table entry before indexing it so the driver keeps selecting the highest supported alternate setting without reading past alts[].

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 312c4450fe23014665c163f480edd5ad2e27bbb8Affected baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 9dd13a8641de79bc1bc93da55cdd35259a002683Affected baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 476c9262b430c38c6a701a3b8176a3f48689085bAffected baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 6fba3c3d48c927e55611a0f5ea34da88138ed0ffAffected baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 834cf890d2c3d29cbfa1ee2376c40469c28ec297Affected baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 1019028eb124564cf7bca58a16f1df8a1ca30726Affected baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 21c254202f9d78abe0fcd642a92966deb92bd226Affected baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 129fa608b6ad08b8ab7178eeb2ec272c993aacccAffected
LinuxLinux	5.8Affected before 5.8Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.131 through 6.6.Not affected 6.12.80 through 6.12.Not affected 6.18.21 through 6.18.Not affected 6.19.11 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 312c4450fe23014665c163f480edd5ad2e27bbb8Affected
baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 9dd13a8641de79bc1bc93da55cdd35259a002683Affected
baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 476c9262b430c38c6a701a3b8176a3f48689085bAffected
baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 6fba3c3d48c927e55611a0f5ea34da88138ed0ffAffected
baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 834cf890d2c3d29cbfa1ee2376c40469c28ec297Affected
baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 1019028eb124564cf7bca58a16f1df8a1ca30726Affected
baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 21c254202f9d78abe0fcd642a92966deb92bd226Affected
baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 to before 129fa608b6ad08b8ab7178eeb2ec272c993aacccAffected

LinuxLinux

5.8Affected
before 5.8Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.131 through 6.6.*Not affected
6.12.80 through 6.12.*Not affected
6.18.21 through 6.18.*Not affected
6.19.11 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.