Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31393— Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未验证L2CAP_INFO_RSP有效载荷长度，可能导致越界读取。

CVSS 8.1 · High EPSS 0.42% · P35

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 4e8402a3f884427f9233ba436459c158d1f2e114< 187e6fe939295be36063a1d91f8bebee04399a8c affected
4e8402a3f884427f9233ba436459c158d1f2e114< 5229e7d15771eac2b5886bfb1f976aea0c1eec14 affected
4e8402a3f884427f9233ba436459c158d1f2e114< 3b646516cba2ebc4b51a72954903326e7c1e443f affected
4e8402a3f884427f9233ba436459c158d1f2e114< 807bd1258453c4c83f6ae9dbc1e7b44860ff40d0 affected
4e8402a3f884427f9233ba436459c158d1f2e114< 9aeacde4da0f02d42fd968fd32f245828b230171 affected
4e8402a3f884427f9233ba436459c158d1f2e114< e7ff754e339e3d5ce29aa9f95352d0186df8fbd9 affected
4e8402a3f884427f9233ba436459c158d1f2e114< db2872d054e467810078e2b9f440a5b326a601b2 affected
4e8402a3f884427f9233ba436459c158d1f2e114< dd815e6e3918dc75a49aaabac36e4f024d675101 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31393

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access l2cap_information_rsp() checks that cmd_len covers the fixed l2cap_info_rsp header (type + result, 4 bytes) but then reads rsp->data without verifying that the payload is present: - L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data), which reads 4 bytes past the header (needs cmd_len >= 8). - L2CAP_IT_FIXED_CHAN reads rsp->data[0], 1 byte past the header (needs cmd_len >= 5). A truncated L2CAP_INFO_RSP with result == L2CAP_IR_SUCCESS triggers an out-of-bounds read of adjacent skb data. Guard each data access with the required payload length check. If the payload is too short, skip the read and let the state machine complete with safe defaults (feat_mask and remote_fixed_chan remain zero from kzalloc), so the info timer cleanup and l2cap_conn_start() still run and the connection is not stalled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未验证L2CAP_INFO_RSP有效载荷长度，可能导致越界读取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 4e8402a3f884427f9233ba436459c158d1f2e114 ~ 187e6fe939295be36063a1d91f8bebee04399a8c -
Linux Linux 2.6.24 -

II. Public POCs for CVE-2026-31393

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31393

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-04-03 · 71 CVEs total

CVE-2026-31402 9.8 CRITICAL nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
CVE-2026-23450 9.8 CRITICAL net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
CVE-2026-23427 9.8 CRITICAL ksmbd: fix use-after-free in durable v2 replay of active file handles
CVE-2026-23428 9.8 CRITICAL ksmbd: fix use-after-free of share_conf in compound request
CVE-2026-23455 9.1 CRITICAL netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
CVE-2026-23425 8.8 HIGH KVM: arm64: Fix ID register initialization for non-protected pKVM guests
CVE-2026-23461 8.8 HIGH Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
CVE-2026-23462 8.8 HIGH Bluetooth: HIDP: Fix possible UAF
CVE-2026-23457 8.6 HIGH netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
CVE-2026-23459 8.2 HIGH ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
CVE-2026-23456 8.2 HIGH netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
CVE-2026-31392 8.1 HIGH smb: client: fix krb5 mount with username option
CVE-2026-31396 7.8 HIGH net: macb: fix use-after-free access to PTP clock
CVE-2026-23432 7.8 HIGH mshv: Fix use-after-free in mshv_map_user_memory error path
CVE-2026-31401 7.8 HIGH HID: bpf: prevent buffer overflow in hid_hw_request
CVE-2026-23458 7.8 HIGH netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
CVE-2026-23437 7.8 HIGH net: shaper: protect late read accesses to the hierarchy
CVE-2026-23444 7.8 HIGH wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
CVE-2026-23449 7.8 HIGH net/sched: teql: Fix double-free in teql_master_xmit
CVE-2026-23445 7.8 HIGH igc: fix page fault in XDP TX timestamps handling

Showing top 20 of 71 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31393

No comments yet

Leave a comment