CVE-2026-31512

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

State: Published
Severity: Not scored
Published: Apr 22, 2026
Updated: May 11, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb.

The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	aac23bf636593cc2d67144aed373a46a1a5f76b1 to before cef09691cfb61f6c91cc27c3d69634f81c8ab949Affected aac23bf636593cc2d67144aed373a46a1a5f76b1 to before 3340be2bafdcc806f048273ea6d8e82a6597aa1bAffected aac23bf636593cc2d67144aed373a46a1a5f76b1 to before e47315b84d0eb188772c3ff5cf073cdbdefca6b4Affected aac23bf636593cc2d67144aed373a46a1a5f76b1 to before 477ad4976072056c348937e94f24583321938df4Affected aac23bf636593cc2d67144aed373a46a1a5f76b1 to before 40c7f7eea2f4d9cb0b3e924254c8c9053372168fAffected aac23bf636593cc2d67144aed373a46a1a5f76b1 to before 8c96f3bd4ae0802db90630be8e9851827e9c9209Affected aac23bf636593cc2d67144aed373a46a1a5f76b1 to before 5ad981249be52f5e4e92e0e97b436b569071cb86Affected aac23bf636593cc2d67144aed373a46a1a5f76b1 to before c65bd945d1c08c3db756821b6bf9f1c4a77b29c6Affected
LinuxLinux	3.14Affected before 3.14Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.131 through 6.6.Not affected 6.12.80 through 6.12.Not affected 6.18.21 through 6.18.Not affected 6.19.11 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

aac23bf636593cc2d67144aed373a46a1a5f76b1 to before cef09691cfb61f6c91cc27c3d69634f81c8ab949Affected
aac23bf636593cc2d67144aed373a46a1a5f76b1 to before 3340be2bafdcc806f048273ea6d8e82a6597aa1bAffected
aac23bf636593cc2d67144aed373a46a1a5f76b1 to before e47315b84d0eb188772c3ff5cf073cdbdefca6b4Affected
aac23bf636593cc2d67144aed373a46a1a5f76b1 to before 477ad4976072056c348937e94f24583321938df4Affected
aac23bf636593cc2d67144aed373a46a1a5f76b1 to before 40c7f7eea2f4d9cb0b3e924254c8c9053372168fAffected
aac23bf636593cc2d67144aed373a46a1a5f76b1 to before 8c96f3bd4ae0802db90630be8e9851827e9c9209Affected
aac23bf636593cc2d67144aed373a46a1a5f76b1 to before 5ad981249be52f5e4e92e0e97b436b569071cb86Affected
aac23bf636593cc2d67144aed373a46a1a5f76b1 to before c65bd945d1c08c3db756821b6bf9f1c4a77b29c6Affected

LinuxLinux

3.14Affected
before 3.14Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.131 through 6.6.*Not affected
6.12.80 through 6.12.*Not affected
6.18.21 through 6.18.*Not affected
6.19.11 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.