Medium 5.5Published Apr 22, 2026

CVE-2026-31512Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

Updated under an hour ago (Oct 28, 2026, 12:20 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb. The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from aac23bf636593cc2d67144aed373a46a1a5f76b1 before cef09691cfb61f6c91cc27c3d69634f81c8ab949; from aac23bf636593cc2d67144aed373a46a1a5f76b1 before 3340be2bafdcc806f048273ea6d8e82a6597aa1b; from aac23bf636593cc2d67144aed373a46a1a5f76b1 before e47315b84d0eb188772c3ff5cf073cdbdefca6b4; from aac23bf636593cc2d67144aed373a46a1a5f76b1 before 477ad4976072056c348937e94f24583321938df4; from aac23bf636593cc2d67144aed373a46a1a5f76b1 before 40c7f7eea2f4d9cb0b3e924254c8c9053372168f; from aac23bf636593cc2d67144aed373a46a1a5f76b1 before 8c96f3bd4ae0802db90630be8e9851827e9c9209; from aac23bf636593cc2d67144aed373a46a1a5f76b1 before 5ad981249be52f5e4e92e0e97b436b569071cb86; from aac23bf636593cc2d67144aed373a46a1a5f76b1 before c65bd945d1c08c3db756821b6bf9f1c4a77b29c6	CNA record
linux linux_kernel linux:linux_kernel	from 3.14.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.131; from 6.7 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11; 3.14; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/cef09691cfb61f6c91cc27c3d69634f81c8ab949	patch
https://git.kernel.org/stable/c/3340be2bafdcc806f048273ea6d8e82a6597aa1b	patch
https://git.kernel.org/stable/c/e47315b84d0eb188772c3ff5cf073cdbdefca6b4	patch
https://git.kernel.org/stable/c/477ad4976072056c348937e94f24583321938df4	patch
https://git.kernel.org/stable/c/40c7f7eea2f4d9cb0b3e924254c8c9053372168f	patch
https://git.kernel.org/stable/c/8c96f3bd4ae0802db90630be8e9851827e9c9209	patch
https://git.kernel.org/stable/c/5ad981249be52f5e4e92e0e97b436b569071cb86	patch
https://git.kernel.org/stable/c/c65bd945d1c08c3db756821b6bf9f1c4a77b29c6	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.