What is the CVSS score of CVE-2026-31393?

CVE-2026-31393 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-31393?

Yes, a patch is available for CVE-2026-31393. Update the affected software to the latest version immediately.

Linux CVE-2026-31393

EUVD-2026-18768 HIGH

Out-of-bounds Read (CWE-125)

2026-04-03 Linux

GHSA-cpmg-r9cr-q8pj

Linux Buffer Overflow Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

4.7 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Apr 27, 2026 - 14:22 NVD

8.1 (HIGH)

Patch available

Apr 16, 2026 - 05:29 EUVD

9aeacde4da0f02d42fd968fd32f245828b230171,807bd1258453c4c83f6ae9dbc1e7b44860ff40d0,3b646516cba2ebc4b51a72954903326e7c1e443f

EUVD ID Assigned

Apr 03, 2026 - 15:30 euvd

EUVD-2026-18768

Analysis Generated

Apr 03, 2026 - 15:30 vuln.today

CVE Published

Apr 03, 2026 - 15:15 nvd

N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access

l2cap_information_rsp() checks that cmd_len covers the fixed l2cap_info_rsp header (type + result, 4 bytes) but then reads rsp->data without verifying that the payload is present:

L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data), which reads

4 bytes past the header (needs cmd_len >= 8).

L2CAP_IT_FIXED_CHAN reads rsp->data[0], 1 byte past the header

(needs cmd_len >= 5).

A truncated L2CAP_INFO_RSP with result == L2CAP_IR_SUCCESS triggers an out-of-bounds read of adjacent skb data.

Guard each data access with the required payload length check. If the payload is too short, skip the read and let the state machine complete with safe defaults (feat_mask and remote_fixed_chan remain zero from kzalloc), so the info timer cleanup and l2cap_conn_start() still run and the connection is not stalled.

AnalysisAI

Out-of-bounds read in Linux kernel Bluetooth L2CAP layer allows remote attackers to read adjacent kernel memory via truncated L2CAP_INFO_RSP packets with insufficient payload length. The l2cap_information_rsp() function validates only the fixed 4-byte header but then unconditionally accesses variable-length payload fields (feat_mask at offset +4 and fixed_chan at offset +1) without verifying the payload is present, triggering kernel memory disclosure on specially crafted Bluetooth frames.

Technical ContextAI

The vulnerability exists in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation, specifically in the l2cap_information_rsp() function that processes L2CAP_INFO_RSP control frames. L2CAP is a core Bluetooth protocol that manages logical channels over a physical Bluetooth link. The vulnerability arises from insufficient validation of skb (socket buffer) payload length before dereferencing rsp->data pointers. The L2CAP_INFO_RSP frame has a minimum fixed header of 4 bytes (type and result fields), but the response data structure contains optional fields: L2CAP_IT_FEAT_MASK requires at least 8 bytes total (4 header + 4 data), and L2CAP_IT_FIXED_CHAN requires at least 5 bytes total (4 header + 1 data). When cmd_len is only 4, the function proceeds to read beyond the allocated skb buffer into adjacent kernel memory, violating bounds on stack or heap allocations.

RemediationAI

Update the Linux kernel to a version containing commit 3b646516cba2ebc4b51a72954903326e7c1e443f or one of its stable backports (listed above). Distributions should apply the fix and publish patched kernel packages. The upstream fix adds length validation before each rsp->data access: check that cmd_len >= 8 before reading L2CAP_IT_FEAT_MASK (4-byte field) and cmd_len >= 5 before reading L2CAP_IT_FIXED_CHAN (1-byte field). If payload is insufficient, the kernel skips the read and allows the state machine to complete with safe zero-initialized defaults, preventing the out-of-bounds access while maintaining connection state integrity. Temporary mitigation: disable Bluetooth on systems that do not require it, or restrict Bluetooth pairing to trusted devices only (note: this is incomplete protection as the vulnerability may be triggerable over the Bluetooth stack after pairing). Reference: https://git.kernel.org/stable/c/3b646516cba2ebc4b51a72954903326e7c1e443f

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2016-1646 HIGH POC

8.8

CVE-2025-5777 HIGH POC

7.5

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-31393 vulnerability details – vuln.today

Back

Linux CVE-2026-31393

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-125 – Out-of-bounds Read

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code