CVE-2026-31513: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31513 is a stack-out-of-bounds read vulnerability in the Linux kernel's Bluetooth L2CAP layer, specifically within the l2cap_ecred_conn_req() function. It is triggered by a malformed Enhanced Credit Based Connection Request containing an excessive number of Source Channel IDs (SCIDs). Affected Linux kernel versions include 6.12.75–6.12.79, 6.18.16–6.18.20, and 6.19.6–6.19.10. The vulnerability was published on April 22, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Feedly).

The root cause is an out-of-bounds read (CWE-125) in l2cap_ecred_conn_req(). The function allocates an 18-byte local stack buffer (pdu) to hold up to 5 SCIDs, but calculates rsp_len from the attacker-controlled cmd_len before validating that the SCID count does not exceed L2CAP_ECRED_MAX_CID. When the SCID count is too high, the function jumps to the response label to reject the packet, but rsp_len retains the oversized attacker-supplied value. As a result, l2cap_send_cmd() reads past the end of the 18-byte pdu buffer, triggering a KASAN panic. The fix moves the rsp_len assignment to after the boundary check, so rejected packets use rsp_len = 0 and only read the 8-byte base header (GitHub Advisory). The attack vector is adjacent network (Bluetooth range), requires no privileges, and no user interaction (GitHub Advisory).

An unauthenticated attacker within Bluetooth range can send a crafted Enhanced Credit Based Connection Request with more than 5 SCIDs to trigger a kernel stack-out-of-bounds read, resulting in a KASAN panic and denial of service. Additionally, the out-of-bounds read may expose sensitive kernel stack memory contents before the panic occurs, creating a confidentiality risk. Integrity is not directly impacted by this vulnerability (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability was originally discovered and reported by Syzbot (Google's kernel fuzzing infrastructure). The EPSS score is approximately 0.018–0.022%, placing it in the 7th percentile for exploitation likelihood. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify a target system running a vulnerable Linux kernel version (6.12.75–6.12.79, 6.18.16–6.18.20, or 6.19.6–6.19.10) with Bluetooth enabled and within physical Bluetooth range.
2. Bluetooth discovery: Use standard Bluetooth scanning tools (e.g., hcitool scan, bluetoothctl) to discover the target device and confirm it is reachable and accepting L2CAP connections.
3. Craft malformed L2CAP packet: Construct a malformed Enhanced Credit Based Connection Request (L2CAP_ECRED_CONN_REQ) packet containing more than 5 Source Channel IDs (SCIDs), exceeding the L2CAP_ECRED_MAX_CID limit. This can be done using raw Bluetooth socket APIs or a custom fuzzing harness similar to Syzbot's approach.
4. Send the packet: Transmit the crafted packet to the target device over Bluetooth. The l2cap_ecred_conn_req() function will compute an oversized rsp_len before performing the SCID count boundary check.
5. Trigger out-of-bounds read: The kernel's l2cap_send_cmd() reads past the end of the 18-byte pdu stack buffer using the attacker-controlled rsp_len, potentially leaking kernel stack memory and triggering a KASAN panic (kernel crash/denial of service) (GitHub Advisory, Feedly).

• Logs: Kernel logs (dmesg, /var/log/kern.log) containing KASAN stack-out-of-bounds read reports referencing l2cap_build_cmd() or l2cap_ecred_conn_req(); kernel panic messages associated with Bluetooth L2CAP processing.
• Network (Bluetooth): Unusual or repeated Bluetooth L2CAP Enhanced Credit Based Connection Requests from unknown or untrusted devices; Bluetooth HCI logs showing malformed L2CAP command packets with abnormally large cmd_len values.
• Process/System: Unexpected kernel crashes or reboots on systems with Bluetooth enabled; KASAN panic traces in crash dumps referencing the net/bluetooth/l2cap_core.c source file.

Apply the available kernel security updates to patched versions: 6.12.80 or later, 6.18.21 or later, and 6.19.11 or later. Patches are available as stable kernel commits: c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc, 5b35f8211a913cfe7ab9d54fa36a272d2059a588, a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b, and 9d87cb22195b2c67405f5485d525190747ad5493 (GitHub Advisory). As a workaround, disable Bluetooth on systems where it is not required (rfkill block bluetooth or unloading the bluetooth kernel module). Restrict Bluetooth connectivity to trusted, paired devices and monitor kernel logs for KASAN panic messages indicating exploitation attempts (Feedly).