Home

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb. The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.

PUBLISHED Reserved 2026-03-09 | Published 2026-04-22 | Updated 2026-04-22 | Assigner Linux

Product status

Default status
unaffected

aac23bf636593cc2d67144aed373a46a1a5f76b1 (git) before cef09691cfb61f6c91cc27c3d69634f81c8ab949
affected

aac23bf636593cc2d67144aed373a46a1a5f76b1 (git) before 3340be2bafdcc806f048273ea6d8e82a6597aa1b
affected

aac23bf636593cc2d67144aed373a46a1a5f76b1 (git) before e47315b84d0eb188772c3ff5cf073cdbdefca6b4
affected

aac23bf636593cc2d67144aed373a46a1a5f76b1 (git) before 477ad4976072056c348937e94f24583321938df4
affected

aac23bf636593cc2d67144aed373a46a1a5f76b1 (git) before 40c7f7eea2f4d9cb0b3e924254c8c9053372168f
affected

aac23bf636593cc2d67144aed373a46a1a5f76b1 (git) before 8c96f3bd4ae0802db90630be8e9851827e9c9209
affected

aac23bf636593cc2d67144aed373a46a1a5f76b1 (git) before 5ad981249be52f5e4e92e0e97b436b569071cb86
affected

aac23bf636593cc2d67144aed373a46a1a5f76b1 (git) before c65bd945d1c08c3db756821b6bf9f1c4a77b29c6
affected

Default status
affected

3.14
affected

Any version before 3.14
unaffected

5.10.253 (semver)
unaffected

5.15.203 (semver)
unaffected

6.1.168 (semver)
unaffected

6.6.131 (semver)
unaffected

6.12.80 (semver)
unaffected

6.18.21 (semver)
unaffected

6.19.11 (semver)
unaffected

7.0 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/cef09691cfb61f6c91cc27c3d69634f81c8ab949

git.kernel.org/...c/3340be2bafdcc806f048273ea6d8e82a6597aa1b

git.kernel.org/...c/e47315b84d0eb188772c3ff5cf073cdbdefca6b4

git.kernel.org/...c/477ad4976072056c348937e94f24583321938df4

git.kernel.org/...c/40c7f7eea2f4d9cb0b3e924254c8c9053372168f

git.kernel.org/...c/8c96f3bd4ae0802db90630be8e9851827e9c9209

git.kernel.org/...c/5ad981249be52f5e4e92e0e97b436b569071cb86

git.kernel.org/...c/c65bd945d1c08c3db756821b6bf9f1c4a77b29c6

cve.org (CVE-2026-31512)

nvd.nist.gov (CVE-2026-31512)

Download JSON