CVE-2026-31772: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31772 Overview

CVE-2026-31772 is a stack buffer overflow vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_le_big_create_sync() function within hci_sync.c. The function uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with capacity for only 0x11 (17) Broadcast Isochronous Stream (BIS) entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31) entries. When conn->num_bis exceeds 17, the memcpy operation writes up to 14 bytes past the stack buffer, corrupting adjacent stack memory.

Critical Impact
A local attacker with permission to create ISO sockets can trigger stack memory corruption in the Linux kernel, leading to denial of service or potential local privilege escalation.

Affected Products

Linux kernel versions containing the vulnerable hci_le_big_create_sync() implementation in the Bluetooth HCI sync subsystem
Distributions shipping affected upstream Linux kernel releases prior to the patch commits
Systems with Bluetooth enabled and ISO socket support compiled in

Discovery Timeline

2026-05-01 - CVE-2026-31772 published to NVD
2026-05-03 - Last updated in NVD database

Technical Details for CVE-2026-31772

Vulnerability Analysis

The flaw resides in the Bluetooth Host Controller Interface (HCI) command synchronization path. The hci_le_big_create_sync() function constructs a hci_cp_le_big_create_sync command structure on the stack to initiate Broadcast Isochronous Group (BIG) sync operations. The structure is allocated with DEFINE_FLEX using a hardcoded count of 0x11 BIS entries, but the input validation in the caller hci_conn_big_create_sync() permits up to ISO_MAX_NUM_BIS (0x1f, 31) entries. This mismatch allows a memcpy of conn->bis into cp->bis to write beyond the allocated stack region.

KASAN reports the issue as stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0, with a write of size 31 at the buffer address. The corruption can overwrite return addresses, saved registers, or adjacent stack variables in the kernel worker thread context.

Root Cause

The root cause is an inconsistency between two constants used for the same logical limit. The stack buffer is sized for 17 BIS entries, while the field conn->num_bis and its validation boundary ISO_MAX_NUM_BIS permit 31 entries. The DEFINE_FLEX macro produces a fixed-size flexible array allocation, and the count argument was set incorrectly to 0x11 rather than HCI_MAX_ISO_BIS.

Attack Vector

An unprivileged local user can reproduce the overflow by binding an ISO socket with bc_num_bis = ISO_MAX_NUM_BIS (31) and invoking listen(). The HCI command sync worker subsequently calls hci_le_big_create_sync() with the attacker-controlled BIS count, triggering the out-of-bounds write. Exploitation requires local access and the ability to open Bluetooth ISO sockets, but no special privileges beyond standard socket creation rights on systems where Bluetooth is enabled.

The vulnerability is described in detail across the upstream fix commits referenced below. See the Kernel Git Commit aba0aea and Kernel Git Commit f5d4466 for the complete patch context.

Detection Methods for CVE-2026-31772

Indicators of Compromise

KASAN kernel log entries containing stack-out-of-bounds in hci_le_big_create_sync accompanied by a write size larger than the expected 17-entry buffer.
Unexpected kernel panics or oopses originating from the kworker/u* HCI command sync worker on systems with Bluetooth enabled.
Audit log entries showing unprivileged processes binding ISO sockets with bc_num_bis values above 17.

Detection Strategies

Monitor kernel ring buffer (dmesg) and /var/log/kern.log for KASAN reports referencing hci_le_big_create_sync, hci_cp_le_big_create_sync, or out-of-bounds writes in Bluetooth subsystem functions.
Use eBPF tracing on hci_le_big_create_sync and hci_conn_big_create_sync to log the conn->num_bis value and flag invocations exceeding 17.
Correlate Bluetooth ISO socket activity (AF_BLUETOOTH with BTPROTO_ISO) against process identity and capability sets to surface anomalous local invocations.

Monitoring Recommendations

Enable kernel hardening features such as KASAN, stack canaries (CONFIG_STACKPROTECTOR_STRONG), and CONFIG_FORTIFY_SOURCE on test and production hosts where feasible.
Centralize kernel logs and alert on crash signatures involving hci_sync.c and Bluetooth ISO code paths.
Track installed kernel versions across the fleet and verify the patch level matches one of the fixed commits before declaring systems remediated.

How to Mitigate CVE-2026-31772

Immediate Actions Required

Apply the upstream Linux kernel patches that change the DEFINE_FLEX count from 0x11 to HCI_MAX_ISO_BIS and reboot affected hosts.
On systems that do not require Bluetooth, blacklist the bluetooth and btusb kernel modules to remove the attack surface entirely.
Restrict creation of AF_BLUETOOTH sockets to trusted users via seccomp profiles, AppArmor, or SELinux policies on multi-user systems.

Patch Information

The vulnerability is fixed by replacing the incorrect 0x11 constant with HCI_MAX_ISO_BIS in the DEFINE_FLEX allocation, ensuring the stack buffer is sized to hold the maximum number of BIS entries that conn->bis can carry. Apply the upstream commits: Kernel Git Commit aba0aea, Kernel Git Commit bc39a09, Kernel Git Commit eaf3200, and Kernel Git Commit f5d4466. Distribution maintainers have backported these fixes; consult your vendor's security tracker for the corresponding package version.

Workarounds

Disable Bluetooth on systems that do not require it using rfkill block bluetooth or by stopping and masking the bluetooth.service unit.
Unload the Bluetooth kernel modules with modprobe -r bluetooth and prevent automatic loading via /etc/modprobe.d/blacklist-bluetooth.conf.
Limit local user access on shared Linux hosts and audit which accounts can open raw Bluetooth sockets until patches are deployed.

bash

# Configuration example: disable Bluetooth stack until patched
sudo systemctl stop bluetooth.service
sudo systemctl mask bluetooth.service
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
echo 'blacklist btusb' | sudo tee -a /etc/modprobe.d/blacklist-bluetooth.conf
sudo rfkill block bluetooth