CVE-2026-31393: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31393 is an out-of-bounds read vulnerability in the Linux kernel's Bluetooth L2CAP subsystem, specifically in the l2cap_information_rsp() function. The function validates that the command length covers the fixed 4-byte l2cap_info_rsp header but fails to verify that the payload data is present before reading from it, allowing a truncated L2CAP_INFO_RSP packet with result == L2CAP_IR_SUCCESS to trigger an out-of-bounds read of adjacent skb memory. Affected kernel versions span from 2.6.24 through multiple stable branches, with fixes available in 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, and 6.19.10. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read). The l2cap_information_rsp() function in the Bluetooth L2CAP subsystem checks that cmd_len is at least 4 bytes (covering the fixed header fields type and result) but does not enforce that the payload portion is present before accessing rsp->data. Specifically, L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data) requiring cmd_len >= 8, and L2CAP_IT_FIXED_CHAN reads rsp->data[0] requiring cmd_len >= 5 — neither check is performed. An attacker on an adjacent Bluetooth network can craft a truncated L2CAP_INFO_RSP frame to trigger the out-of-bounds read of kernel socket buffer (skb) memory adjacent to the response data (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker on an adjacent Bluetooth network to read sensitive kernel memory adjacent to the skb data structure, resulting in a high-severity confidentiality impact (kernel memory disclosure). Availability is also rated high, as the malformed packet can disrupt the Bluetooth connection state machine; however, the fix ensures the state machine completes with safe defaults so the connection is not permanently stalled. Integrity is not directly impacted by this vulnerability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target system running a vulnerable Linux kernel version (2.6.24 through the unpatched stable branches) with Bluetooth enabled and discoverable, using tools such as hcitool scan or bluetoothctl.
2. Establish Bluetooth proximity: Position within Bluetooth radio range of the target device (typically within ~10 meters for Class 2 devices).
3. Initiate L2CAP connection: Use a Bluetooth stack (e.g., BlueZ with raw socket access) to initiate an L2CAP connection to the target, triggering the information request/response exchange.
4. Craft truncated L2CAP_INFO_RSP: Construct a malformed L2CAP_INFO_RSP packet where result == L2CAP_IR_SUCCESS but cmd_len is set to exactly 4 bytes (the header only), omitting the payload data that L2CAP_IT_FEAT_MASK or L2CAP_IT_FIXED_CHAN processing would attempt to read.
5. Trigger out-of-bounds read: Send the crafted packet to the target; the kernel's l2cap_information_rsp() will read 4 bytes (or 1 byte) past the end of the provided data into adjacent skb memory.
6. Collect disclosed memory: Capture any observable side effects or responses that may leak kernel memory contents, potentially revealing sensitive data such as kernel pointers or heap contents useful for further exploitation (GitHub Advisory).

• Network: Unexpected or malformed L2CAP INFO_RSP frames with cmd_len of exactly 4 bytes and result == L2CAP_IR_SUCCESS observed in Bluetooth traffic captures (e.g., via btmon or Wireshark with Bluetooth HCI dissector).
• Logs: Kernel log entries (dmesg) showing BUG, KASAN (Kernel Address Sanitizer), or UBSAN warnings related to out-of-bounds access in l2cap_information_rsp() or the Bluetooth subsystem; entries referencing net/bluetooth/l2cap_core.c.
• Process: Unexpected Bluetooth daemon (bluetoothd) crashes or restarts; anomalous kernel oops or panic traces referencing L2CAP functions.
• Network: Repeated Bluetooth connection attempts from unknown or spoofed MAC addresses, particularly targeting the L2CAP information exchange phase.

Apply the upstream Linux kernel patches available for the following stable versions: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, and 6.19.10 (GitHub Advisory). Distribution-specific updates have been released by SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1) and Debian. As a workaround where patching is not immediately possible, disable Bluetooth entirely (rfkill block bluetooth) or restrict Bluetooth access at the physical/network level to trusted devices only (Feedly).

The vulnerability was disclosed via the Linux kernel CVE announcement mailing list and tracked by the Yocto Project security team, which issued multiple security advisories. SUSE released several security updates addressing this CVE. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution update channels.