{"id":"CVE-2026-31771","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the …","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.10, < 6.19.12","linux_kernel = 7.0"],"patched":["linux_kernel 6.19.12"],"published":"2026-05-01","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:29.263","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31771","references":[{"url":"https://git.kernel.org/stable/c/2b2bf47cd75518c36fa2d41380e4a40641cc89cd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/86c8d07a64d553c41e213b52650020010f9ef23e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00311,"epssPercentile":0.22287,"ingestedAt":"2026-10-15T11:00:41.713Z","slug":"CVE-2026-31771","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the HCI event header but before hci_event_func()\nenforces the per-event minimum payload length from hci_ev_table.\nThis means a short HCI event frame can reach bacpy() before any bounds\ncheck runs.\n\nRather than duplicating skb parsing and per-event length checks inside\nhci_store_wake_reason(), move wake-address storage into the individual\nevent handlers after their existing event-length validation has\nsucceeded. Convert hci_store_wake_reason() into a small helper that only\nstores an already-validated bdaddr while the caller holds hci_dev_lock().\nUse the same helper after hci_event_func() with a NULL address to\npreserve the existing unexpected-wake fallback semantics when no\nvalidated event handler records a wake address.\n\nAnnotate the helper with __must_hold(&hdev->lock) and add\nlockdep_assert_held(&hdev->lock) so future call paths keep the lock\ncontract explicit.\n\nCall the helper from hci_conn_request_evt(), hci_conn_complete_evt(),\nhci_sync_conn_complete_evt(), le_conn_complete_evt(),\nhci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),\nhci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and\nhci_le_past_received_evt().\n\n## Affected\n\n- `linux_kernel >= 5.10, < 6.19.12`\n- `linux_kernel = 7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.19.12`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}