CyberSecBulletin
CVE-2026-31513NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-31513 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc, 5b35f8211a913cfe7ab9d54fa36a272d2059a588, a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.25% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc or 5b35f8211a913cfe7ab9d54fa36a272d2059a588 or a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b or 9d87cb22195b2c67405f5485d525190747ad5493, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.12.80 or 6.18.21 or 6.19.11, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux935f324e4b2461df2cf7f02b4195082b4304c708 up to, but not including, c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc; e981a9392800ce2c5bca196a6ab2c55e9370efaa up to, but not including, 5b35f8211a913cfe7ab9d54fa36a272d2059a588; f3fdf2e7276a3edc5df55454275da20eac186970 up to, but not including, a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b; c28d2bff70444a85b3b86aaf241ece9408c7858c up to, but not including, 9d87cb22195b2c67405f5485d525190747ad5493; 6.12.75 up to, but not including, 6.12.80; 6.18.16 up to, but not including, 6.18.21; 6.19.6 up to, but not including, 6.19.11c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc, 5b35f8211a913cfe7ab9d54fa36a272d2059a588, a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b, 9d87cb22195b2c67405f5485d525190747ad5493, 6.12.80, 6.18.21
LinuxLinux Kernel6.12.75 up to, but not including, 6.12.80; 6.18.16 up to, but not including, 6.18.21; 6.19.6 up to, but not including, 6.19.116.12.80, 6.18.21, 6.19.11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req Syzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd() that is triggered by a malformed Enhanced Credit Based Connection Request. The vulnerability stems from l2cap_ecred_conn_req(). The function allocates a local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel IDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more than 5 SCIDs, the function calculates `rsp_len` based on this unvalidated `cmd_len` before checking if the number of SCIDs exceeds L2CAP_ECRED_MAX_CID. If the SCID count is too high, the function correctly jumps to the `response` label to reject the packet, but `rsp_len` retains the attacker's oversized value. Consequently, l2cap_send_cmd() is instructed to read past the end of the 18-byte `pdu` buffer, triggering a KASAN panic. Fix this by moving the assignment of `rsp_len` to after the `num_scid` boundary check. If the packet is rejected, `rsp_len` will safely remain 0, and the error response will only read the 8-byte base header from the stack.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.