CVE-2026-31498: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31498 is a Linux kernel vulnerability in the Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) subsystem affecting the Enhanced Retransmission Mode (ERTM) reconfiguration path. It encompasses two related flaws: a memory leak caused by re-initializing ERTM queues without freeing prior allocations during channel reconfiguration, and an infinite loop triggered by an unvalidated zero pdu_len value that exhausts all available kernel memory. The vulnerability affects a wide range of Linux kernel versions from 4.4.238 through 6.19.10, as well as 7.0 release candidates. It was published on April 22, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability has two root causes classified under CWE-606 (Unchecked Input for Loop Condition) and CWE-835 (Loop with Unreachable Exit Condition). First, l2cap_config_req() processes CONFIG_REQ for channels already in BT_CONNECTED state and falls through to l2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and retrans_list without freeing previous allocations, and sets chan->sdu to NULL without freeing the existing socket buffer (SKB), leaking all previously allocated ERTM resources. Second, l2cap_parse_conf_req() fails to validate the minimum value of remote_mps derived from the RFC max_pdu_size option; a zero value propagates to l2cap_segment_sdu() where pdu_len becomes zero, causing the while loop to never terminate as len is never decremented, exhausting all available memory. The fix skips l2cap_ertm_init() and l2cap_chan_ready() when the channel is already in BT_CONNECTED state and adds a pdu_len zero check in l2cap_segment_sdu() (GitHub Advisory).

Successful exploitation allows a local attacker with low privileges to cause a denial of service by exhausting all available kernel memory, rendering the system unusable. The infinite loop triggered by a zero pdu_len value will consume all memory, while repeated ERTM re-initialization without proper cleanup causes cumulative memory leaks that further deplete kernel resources. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires local access with low privileges, limiting its remote exploitability. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

• Logs: Kernel OOM (Out-of-Memory) killer messages in /var/log/kern.log or dmesg output indicating memory exhaustion without an obvious cause; repeated kernel warnings related to Bluetooth L2CAP or ERTM subsystems.
• Process/System Behavior: Sudden and unexplained system memory exhaustion on systems with active Bluetooth connections; system becoming unresponsive or processes being killed by the OOM killer while Bluetooth is in use.
• Network/Bluetooth: Unusual or malformed L2CAP CONFIG_REQ packets with RFC max_pdu_size set to zero observed in Bluetooth traffic captures (e.g., via btmon or hcidump).

Apply the available kernel patches for the respective stable series: 5.10.253+, 5.15.203+, 6.1.168+, 6.6.131+, 6.12.80+, 6.18.21+, 6.19.11+, and 7.0 final (GitHub Advisory). Debian has also released updated kernel packages incorporating these fixes (Debian Tracker). As interim workarounds for systems that cannot be patched immediately: disable Bluetooth if not required, restrict local access and Bluetooth permissions to trusted users only, and monitor kernel memory consumption for unusual patterns.