CVE-2026-31510— Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于l2cap_sock_ready_cb中未检查空指针，可能导致空指针取消引用。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 54a59aa2b562872781d6a8fc89f300d360941691< d34776c7fa1f2c510f1cdd14823aba701babb4ad |
affected |
54a59aa2b562872781d6a8fc89f300d360941691< 03d4eafb0f3788239df63575951f6b4c97bbfda4 |
affected | ||
54a59aa2b562872781d6a8fc89f300d360941691< 3c821bc0fbeaa27910a20d0b43c6008d099792af |
affected | ||
54a59aa2b562872781d6a8fc89f300d360941691< a04a760c06bb591989db659439efdf106f0bae76 |
affected | ||
54a59aa2b562872781d6a8fc89f300d360941691< 0780f9333852971ca77d110019e3a66ce5a7b100 |
affected | ||
54a59aa2b562872781d6a8fc89f300d360941691< 1dc6db047919ecd59493cd51248b37381bbabcbb |
affected | ||
54a59aa2b562872781d6a8fc89f300d360941691< 898b89c90ff9496e64b9331040778cc4e1b28c9d |
affected | ||
54a59aa2b562872781d6a8fc89f300d360941691< b6552e0503973daf6f23bd6ed9273ef131ee364f |
affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-31510
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Before using sk pointer, check if it is null.
Fix the following:
KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]
CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025
Workqueue: events l2cap_info_timeout
RIP: 0010:kasan_byte_accessible+0x12/0x30
Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
veth0_macvtap: entered promiscuous mode
RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0
PKRU: 55555554
Call Trace:
<TASK>
__kasan_check_byte+0x12/0x40
lock_acquire+0x79/0x2e0
lock_sock_nested+0x48/0x100
? l2cap_sock_ready_cb+0x46/0x160
l2cap_sock_ready_cb+0x46/0x160
l2cap_conn_start+0x779/0xff0
? __pfx_l2cap_conn_start+0x10/0x10
? l2cap_info_timeout+0x60/0xa0
? __pfx___mutex_lock+0x10/0x10
l2cap_info_timeout+0x68/0xa0
? process_scheduled_works+0xa8d/0x18c0
process_scheduled_works+0xb6e/0x18c0
? __pfx_process_scheduled_works+0x10/0x10
? assign_work+0x3d5/0x5e0
worker_thread+0xa53/0xfc0
kthread+0x388/0x470
? __pfx_worker_thread+0x10/0x10
? __pfx_kthread+0x10/0x10
ret_from_fork+0x51e/0xb90
? __pfx_ret_from_fork+0x10/0x10
veth1_macvtap: entered promiscuous mode
? __switch_to+0xc7d/0x1450
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
batman_adv: batadv0: Interface activated: batadv_slave_0
batman_adv: batadv0: Interface activated: batadv_slave_1
netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
RIP: 0010:kasan_byte_accessible+0x12/0x30
Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
ieee80211 phy39: Selected rate control algorithm 'minstrel_ht'
RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0
PKRU: 55555554
Kernel panic - not syncing: Fatal exception
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于l2cap_sock_ready_cb中未检查空指针，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-31510
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-31510
请登录查看更多情报信息。
Same Patch Batch · Linux · 2026-04-22 · 100 CVEs total
| CVE-2026-31463 | 9.8 CRITICAL | iomap: fix invalid folio access when i_blkbits differs from I/O granularity |
| CVE-2026-31444 | 9.8 CRITICAL | ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() |
| CVE-2026-31501 | 9.8 CRITICAL | net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path |
| CVE-2026-31436 | 9.8 CRITICAL | dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() |
| CVE-2026-31478 | 9.8 CRITICAL | ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() |
| CVE-2026-31448 | 9.4 CRITICAL | ext4: avoid infinite loops caused by residual data |
| CVE-2026-31432 | 8.8 HIGH | ksmbd: fix OOB write in QUERY_INFO for compound requests |
| CVE-2026-31433 | 8.8 HIGH | ksmbd: fix potencial OOB in get_file_all_info() for compound requests |
| CVE-2026-31450 | 8.8 HIGH | ext4: publish jinode after initialization |
| CVE-2026-31435 | 8.8 HIGH | netfs: Fix read abandonment during retry |
| CVE-2026-31476 | 8.2 HIGH | ksmbd: do not expire session on binding failure |
| CVE-2026-31464 | 8.1 HIGH | scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() |
| CVE-2026-31513 | 8.1 HIGH | Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req |
| CVE-2026-31446 | 7.8 HIGH | ext4: fix use-after-free in update_super_work when racing with umount |
| CVE-2026-31449 | 7.8 HIGH | ext4: validate p_idx bounds in ext4_ext_correct_indexes |
| CVE-2026-31502 | 7.8 HIGH | team: fix header_ops type confusion with non-Ethernet ports |
| CVE-2026-31431 | 7.8 HIGH | crypto: algif_aead - Revert to operating out-of-place |
| CVE-2026-31488 | 7.8 HIGH | drm/amd/display: Do not skip unrelated mode changes in DSC validation |
| CVE-2026-31490 | 7.8 HIGH | drm/xe/pf: Fix use-after-free in migration restore |
| CVE-2026-31454 | 7.8 HIGH | xfs: save ailp before dropping the AIL lock in push callbacks |
Showing top 20 of 100 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
Same vendor: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
V. Comments for CVE-2026-31510
No comments yet