---
id: CVE-2026-31772
title: 'Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

  hci_le_big_create_sync() uses DEFINE_FLEX to allocate a
  struct hci_cp_le_big_create_sync on th…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 91d19383b7ed035e22165ae5c836e50bb9f95fbe <
    f5d446624345d309e7a4a1b27ea9f028d6a8c5d9
  - >-
    Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 <
    aba0aea354015794e8312dd7efe726967e58aefe
  - >-
    Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 <
    eaf32002ca7b1ba51c9f140991fd9febe6de79f0
  - >-
    Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 <
    bc39a094730ce062fa034a529c93147c096cb488
  - Linux 8958e1cee4e2eac1a5b825caa4dd96ce9ed975dd
  - Linux >= 6.12.2 < 6.12.81
  - Linux >= 6.11.11 < 6.12
  - Linux 6.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:13:07.170153Z'
published: '2026-05-01'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:26.528Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31772'
references:
  - url: 'https://git.kernel.org/stable/c/f5d446624345d309e7a4a1b27ea9f028d6a8c5d9'
  - url: 'https://git.kernel.org/stable/c/aba0aea354015794e8312dd7efe726967e58aefe'
  - url: 'https://git.kernel.org/stable/c/eaf32002ca7b1ba51c9f140991fd9febe6de79f0'
  - url: 'https://git.kernel.org/stable/c/bc39a094730ce062fa034a529c93147c096cb488'
tags:
  - cve.org
epss: 0.00189
epssPercentile: 0.08013
ingestedAt: '2026-10-16T17:24:46.674Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

hci_le_big_create_sync() uses DEFINE_FLEX to allocate a
struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17)
BIS entries.  However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31)
entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller
hci_conn_big_create_sync().  When conn->num_bis is between 18 and 31,
the memcpy that copies conn->bis into cp->bis writes up to 14 bytes
past the stack buffer, corrupting adjacent stack memory.

This is trivially reproducible: binding an ISO socket with
bc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will
eventually trigger hci_le_big_create_sync() from the HCI command
sync worker, causing a KASAN-detectable stack-out-of-bounds write:

  BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0
  Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71

Fix this by changing the DEFINE_FLEX count from the incorrect 0x11 to
HCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that
conn->bis can actually carry.

## Affected

- `Linux >= 91d19383b7ed035e22165ae5c836e50bb9f95fbe < f5d446624345d309e7a4a1b27ea9f028d6a8c5d9`
- `Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < aba0aea354015794e8312dd7efe726967e58aefe`
- `Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < eaf32002ca7b1ba51c9f140991fd9febe6de79f0`
- `Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < bc39a094730ce062fa034a529c93147c096cb488`
- `Linux 8958e1cee4e2eac1a5b825caa4dd96ce9ed975dd`
- `Linux >= 6.12.2 < 6.12.81`
- `Linux >= 6.11.11 < 6.12`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.