CVE-2026-31512: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31512 is a buffer validation flaw in the Linux kernel's Bluetooth L2CAP module affecting the Enhanced Credit Based Flow Control (eCRED) data path. The vulnerability exists in l2cap_ecred_data_rcv(), which reads the SDU length field from skb->data without first verifying that at least L2CAP_SDULEN_SIZE (2) bytes are available, potentially reading past valid data boundaries when processing malformed packets. It affects Linux kernel versions from 3.14 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0+. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is an improper buffer length validation (CWE-125: Out-of-bounds Read) in the l2cap_ecred_data_rcv() function within the Linux kernel's Bluetooth L2CAP subsystem. When an incoming eCRED packet's skb->len is less than 2 bytes, the call to get_unaligned_le16() reads past the valid data in the socket buffer. The fix applies the same pskb_may_pull() validation already used in the ERTM reassembly path (l2cap_reassemble_sdu, L2CAP_SAR_START case) to the eCRED data path. Exploitation requires local network access to send malformed Bluetooth L2CAP packets to a vulnerable system (GitHub Advisory).

Successful exploitation can result in an out-of-bounds kernel memory read, leading to either kernel memory disclosure (information leakage) or a kernel crash (denial of service). The availability impact is rated High, while confidentiality and integrity are not directly impacted per the CVSS assessment. The vulnerability is scoped to the local system and does not provide a direct path for remote code execution or lateral movement (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.024%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to send crafted Bluetooth L2CAP packets, limiting the practical attack surface (GitHub Advisory, Feedly).

Apply the available kernel security updates for the affected stable branches. Fixed versions are: 5.10.253+, 5.15.203+, 6.1.168+, 6.6.131+, 6.12.80+, 6.18.21+, 6.19.11+, and Linux kernel 7.0+. Patches are available via the upstream kernel stable tree and have been incorporated into downstream distributions including SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:2111-1, SUSE-SU-2026:2195-1, SUSE-SU-2026:2215-1, SUSE-SU-2026:2238-1), openSUSE, and Debian. As a temporary workaround where patching is not immediately possible, disabling Bluetooth or restricting Bluetooth access on systems where it is not required reduces exposure (GitHub Advisory, SUSE Advisory).

The vulnerability has been addressed by multiple Linux distribution vendors including SUSE and Debian, who have issued security advisories and updated packages. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and patch notifications (SUSE Advisory, Debian Tracker).