01 Record

CVE-2026-31393

Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access

HighPUBLISHEDCNA: Linux

CNA base score8.1 CVSS v3.xCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

View raw JSON

02 Description

Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.25% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 17.0% of scored records. A rank, not a probability.

NVD base score

8.1 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-04-03 15:15Z6 MO AGO

Last updated

2026-10-19 18:35Z9 DAYS AGO

Reserved

2026-03-09

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.1)

CNA CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weaknesses

CWE-125Out-of-bounds ReadBase

Data version

5.2

Document digest

3cb66d1655fb08d0bc5bf5b80585f568a2a807b17a2b7e3ac493914ff18e7a7f

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux4e8402a3f884427f9233ba436459c158d1f2e114 to < 187e6fe939295be36063a1d91f8bebee04399a8c, 4e8402a3f884427f9233ba436459c158d1f2e114 to < 5229e7d15771eac2b5886bfb1f976aea0c1eec14, 4e8402a3f884427f9233ba436459c158d1f2e114 to < 3b646516cba2ebc4b51a72954903326e7c1e443f, 4e8402a3f884427f9233ba436459c158d1f2e114 to < 807bd1258453c4c83f6ae9dbc1e7b44860ff40d0, 4e8402a3f884427f9233ba436459c158d1f2e114 to < 9aeacde4da0f02d42fd968fd32f245828b230171, 4e8402a3f884427f9233ba436459c158d1f2e114 to < e7ff754e339e3d5ce29aa9f95352d0186df8fbd9, 4e8402a3f884427f9233ba436459c158d1f2e114 to < db2872d054e467810078e2b9f440a5b326a601b2, 4e8402a3f884427f9233ba436459c158d1f2e114 to < dd815e6e3918dc75a49aaabac36e4f024d675101, 2.6.24—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/187e6fe939295be36063a1d91f8bebee04399a8c
git.kernel.orghttps://git.kernel.org/stable/c/5229e7d15771eac2b5886bfb1f976aea0c1eec14
git.kernel.orghttps://git.kernel.org/stable/c/3b646516cba2ebc4b51a72954903326e7c1e443f
git.kernel.orghttps://git.kernel.org/stable/c/807bd1258453c4c83f6ae9dbc1e7b44860ff40d0
git.kernel.orghttps://git.kernel.org/stable/c/9aeacde4da0f02d42fd968fd32f245828b230171
git.kernel.orghttps://git.kernel.org/stable/c/e7ff754e339e3d5ce29aa9f95352d0186df8fbd9
git.kernel.orghttps://git.kernel.org/stable/c/db2872d054e467810078e2b9f440a5b326a601b2
git.kernel.orghttps://git.kernel.org/stable/c/dd815e6e3918dc75a49aaabac36e4f024d675101

07 Fixed in

Debian 12

linux
Fixed in 6.1.170-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.85-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.19.10-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.