CVE-2026-31497: Linux Kernel Bluetooth Buffer Overflow

CVE-2026-31497 Overview

A vulnerability has been identified in the Linux kernel's Bluetooth USB driver (btusb) that allows an out-of-bounds array read when handling SCO (Synchronous Connection-Oriented) links. The btusb_work() function maps the number of active SCO links to USB alternate settings through a three-entry lookup table when CVSD traffic uses transparent voice settings. However, the lookup operation indexes the alts[] array with data->sco_num - 1 without first constraining sco_num to the number of available table entries, potentially causing the driver to read past the bounds of the array.

Critical Impact

Unconstrained array indexing in the btusb driver can lead to out-of-bounds memory reads when handling Bluetooth SCO connections, potentially causing system instability or information disclosure.

Affected Products

• Linux kernel (multiple stable branches affected)
• Systems with Bluetooth USB adapters using the btusb driver
• Devices utilizing SCO/CVSD voice traffic over Bluetooth

Discovery Timeline

• April 22, 2026 - CVE-2026-31497 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31497

Vulnerability Analysis

The vulnerability exists in the btusb_work() function within the Linux kernel's Bluetooth USB driver. The function is responsible for selecting appropriate USB alternate settings based on the number of active SCO links. A three-entry lookup table (alts[]) is used to map SCO link counts to USB alternate settings when CVSD traffic uses transparent voice settings.

The root cause is insufficient bounds checking before array indexing. The data->sco_num value, which comes from hci_conn_num() and represents the count of active SCO connections, is used directly as an index into the alts[] array without verification that it falls within the valid range (1-3). If more than three SCO links are active, the array access would read memory beyond the intended bounds of the alts[] array.

Root Cause

The vulnerability stems from missing input validation on the sco_num parameter before using it as an array index. While the lookup table alts[] only defines alternate settings for up to three SCO links, the code path does not enforce this constraint. The hci_conn_num() function can potentially return values exceeding this limit, and the driver proceeds to use this unconstrained value directly in the array indexing operation alts[data->sco_num - 1].

Attack Vector

This is a local kernel vulnerability that could be triggered under specific conditions:

1. An attacker or system condition causes more than three SCO connections to be established or reported via hci_conn_num()
2. The btusb_work() function is invoked to handle USB alternate setting selection
3. The unconstrained sco_num value causes an out-of-bounds read when indexing the alts[] array

The exploitation requires local access and the ability to influence Bluetooth connection states. The impact could include reading adjacent kernel memory (information disclosure) or causing undefined behavior that could lead to system instability or denial of service.

Detection Methods for CVE-2026-31497

Indicators of Compromise

• Kernel oops or panic messages referencing the btusb module or btusb_work function
• Unexpected system crashes when establishing multiple Bluetooth SCO connections
• Memory corruption indicators in kernel logs related to Bluetooth subsystem operations

Detection Strategies

• Monitor kernel logs for out-of-bounds access warnings related to the btusb driver
• Implement kernel address sanitizer (KASAN) to detect out-of-bounds memory accesses during testing
• Review Bluetooth connection logs for anomalous SCO link count values exceeding expected thresholds

Monitoring Recommendations

• Enable kernel tracing for Bluetooth subsystem events, particularly SCO connection handling
• Configure system monitoring to alert on btusb driver errors or unexpected behavior
• Deploy endpoint detection solutions capable of monitoring kernel-level activity for signs of exploitation attempts

How to Mitigate CVE-2026-31497

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the bounds-checking fix
• Review system exposure to Bluetooth-related attack surfaces and restrict access where possible
• Monitor affected systems for signs of exploitation until patches can be applied

Patch Information

The Linux kernel maintainers have released patches across multiple stable branches to address this vulnerability. The fix caps the lookup index to the last valid table entry before performing the array access, ensuring the driver continues to select the highest supported alternate setting without reading past the alts[] array bounds.

Patches are available through the following kernel commits:

• Commit 1019028e
• Commit 129fa608
• Commit 21c25420
• Commit 312c4450
• Commit 476c9262
• Commit 6fba3c3d
• Commit 834cf890
• Commit 9dd13a86

Workarounds

• Disable Bluetooth functionality on systems where it is not required using rfkill block bluetooth
• Blacklist the btusb driver module if USB Bluetooth adapters are not needed: add blacklist btusb to /etc/modprobe.d/blacklist.conf
• Limit physical access to affected systems to reduce local attack surface until patches are applied

# Disable Bluetooth USB module if not required
echo "blacklist btusb" >> /etc/modprobe.d/blacklist-btusb.conf
modprobe -r btusb

# Alternatively, disable Bluetooth at runtime
rfkill block bluetooth