Linux Kernel Bluetooth stack Vulnerability Rated 8.1 CVSS

Status: UPDATED  |  Advisory ID: CVE-2026-31771

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: move wake reason storage into validated event handlers

hci_store_wake_reason() is called from hci_event_packet() immediately

after stripping the HCI event header but before hci_event_func()

enforces the per-event minimum payload length from hci_ev_table.

This means a short HCI event frame can reach bacpy() before any bounds

check runs.

Rather than duplicating skb parsing and per-event length checks inside

hci_store_wake_reason(), move wake-address storage into the individual

event handlers after their existing event-length validation has

succeeded. Convert hci_store_wake_reason() into a small helper that only

stores an already-validated bdaddr while the caller holds hci_dev_lock().

Use the same helper after hci_event_func() with a NULL address to

preserve the existing unexpected-wake fallback semantics when no

validated event handler records a wake address.

Annotate the helper with __must_hold(&hdev->lock) and add

lockdep_assert_held(&hdev->lock) so future call paths keep the lock

contract explicit.

Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(),

hci_sync_conn_complete_evt(), le_conn_complete_evt(),

hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),

hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and

hci_le_past_received_evt(). (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References