CVE-2026-31510: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31510 is a NULL pointer dereference vulnerability in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) subsystem, specifically in the l2cap_sock_ready_cb function. The flaw occurs when the socket (sk) pointer is not validated before use during L2CAP connection processing, allowing a local attacker to trigger a kernel panic. Affected kernel versions span from 3.6.1 through 7.0-rc7, including stable branches prior to 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, and 6.19.11. It was published on April 22, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In l2cap_sock_ready_cb, the kernel code proceeds to use the sk socket pointer without first checking whether it is NULL, which can occur during certain L2CAP connection setup sequences when the l2cap_info_timeout workqueue handler fires. The call trace shows the crash path: l2cap_info_timeout → l2cap_conn_start → l2cap_sock_ready_cb → lock_sock_nested, where dereferencing the NULL sk pointer triggers a KASAN-detected fault in the range [0x0000000000000260–0x0000000000000267]. Exploitation requires local access and low privileges; no user interaction is needed. The fix adds a NULL check on the sk pointer before it is used (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes a kernel panic (fatal exception), resulting in an immediate system crash and complete loss of availability. There is no impact on confidentiality or data integrity, as the vulnerability is limited to a denial-of-service condition. Systems with Bluetooth enabled and accessible to untrusted local users are at greatest risk; the crash cannot be recovered without a reboot (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), placing it in the 3rd percentile for exploitation likelihood within 30 days (GitHub Advisory).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267] or Kernel panic - not syncing: Fatal exception originating from the Bluetooth/L2CAP subsystem.
• Logs: Call trace entries referencing l2cap_sock_ready_cb, l2cap_conn_start, or l2cap_info_timeout in kernel crash logs.
• Process: Unexpected kernel worker process (kworker/0:5 or similar) associated with the events workqueue triggering a system crash.
• System: Sudden, unexplained system reboots or kernel panics on hosts with Bluetooth enabled (GitHub Advisory).

Apply the latest stable kernel patches for your Linux kernel branch: 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, or 6.19.11. Patch commits are available in the git.kernel.org repository (merged April 28, 2026). As a workaround, disable Bluetooth functionality (rfkill block bluetooth or unloading the bluetooth kernel module) on systems where it is not required, and restrict local system access to trusted users only (GitHub Advisory, Red Hat Bugzilla).