What is the CVSS score of CVE-2026-31500?

CVE-2026-31500 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Linux Kernel are affected by CVE-2026-31500?

CVE-2026-31500 is a local privilege escalation vulnerability in the Linux kernel Bluetooth Intel driver affecting versions 4.3 through 7.0-rc5 that allows authenticated users to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-31500?

Within 24 hours: Identify all systems running Linux kernel versions 4.3-7.0-rc5 and assess exposure to non-root user access. Within 7 days: Apply vendor-released patches (kernel versions 6.6.131, 6.12.80, 6.18.21, 6.19.11, or 7.0 and later). Within 30 days: Complete patching validation across production and non-production environments; verify Bluetooth Intel driver functionality post-patch.

Linux Kernel CVE-2026-31500

EUVD-2026-24876 HIGH

Use After Free (CWE-416)

2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Use After Free Linux Memory Corruption Intel Information Disclosure

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

6.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 14:07 vuln.today

CVSS changed

Apr 28, 2026 - 14:07 NVD

7.8 (HIGH)

Patch released

Apr 28, 2026 - 13:57 nvd

Patch available

Apr 22, 2026 - 16:33 EUVD

EUVD ID Assigned

Apr 22, 2026 - 14:22 euvd

EUVD-2026-24876

Analysis Generated

Apr 22, 2026 - 14:22 vuln.today

CVE Published

Apr 22, 2026 - 14:16 nvd

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock

btintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET and Intel exception-info retrieval) without holding hci_req_sync_lock(). This lets it race against hci_dev_do_close() -> btintel_shutdown_combined(), which also runs __hci_cmd_sync() under the same lock. When both paths manipulate hdev->req_status/req_rsp concurrently, the close path may free the response skb first, and the still-running hw_error path hits a slab-use-after-free in kfree_skb().

Wrap the whole recovery sequence in hci_req_sync_lock/unlock so it is serialized with every other synchronous HCI command issuer.

Below is the data race report and the kasan report:

BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined

read of hdev->req_rsp at net/bluetooth/hci_sync.c:199 by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254 hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030

write/free by task ioctl/22580: btintel_shutdown_combined+0xd0/0x360 drivers/bluetooth/btintel.c:3648 hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246 hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526

BUG: KASAN: slab-use-after-free in sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202 Read of size 4 at addr ffff888144a738dc by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260

AnalysisAI

Use-after-free in Linux kernel Bluetooth Intel driver enables local privilege escalation to kernel code execution. Affects Linux kernel 4.3 through 7.0-rc5, with patches available in versions 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0. Exploitation requires local authenticated access with low privileges (CVSS PR:L). EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. No public exploit code or active exploitation confirmed at time of analysis, though technical details in CVE description provide implementation roadmap.

Technical ContextAI

This vulnerability affects the btintel driver in the Linux kernel's Bluetooth subsystem, specifically the Intel hardware error recovery mechanism. The root cause is a CWE-416 use-after-free condition stemming from insufficient synchronization primitives. The btintel_hw_error() function issues synchronous HCI commands (__hci_cmd_sync()) for device reset and Intel exception-info retrieval without acquiring the hci_req_sync_lock mutex. This creates a race window with hci_dev_do_close() -> btintel_shutdown_combined(), which executes under the same lock. When both code paths concurrently manipulate shared kernel memory structures (hdev->req_status and hdev->req_rsp), the close path may deallocate the response skb while the hw_error path still holds a reference, triggering a slab-use-after-free detected by KASAN. The vulnerability exists in the netstack's HCI synchronous command infrastructure where concurrent access to request-response state machines leads to premature memory freeing. CPE data confirms impact across mainline kernel versions from 4.3 through 7.0-rc5, with backported fixes to stable branches 6.6.x, 6.12.x, 6.18.x, and 6.19.x.

RemediationAI

Upgrade to patched Linux kernel versions: 6.6.131 or later for 6.6.x series, 6.12.80+ for 6.12.x, 6.18.21+ for 6.18.x, 6.19.11+ for 6.19.x, or 7.0 stable release. Upstream fixes available in git commits 66696648af47 (6.18), f7d84737663a (6.19), 94d8e6fe5d08 (mainline), 5f84e845648d (6.12), and e10a4cb72468 (6.6) per references at https://git.kernel.org/stable/. The patch adds hci_req_sync_lock/unlock around the btintel_hw_error() recovery sequence to serialize with other HCI command issuers. No effective workarounds exist since disabling Bluetooth entirely prevents the driver from loading but severely impacts functionality. Blacklisting the btintel module (echo 'blacklist btintel' >> /etc/modprobe.d/bluetooth-blacklist.conf) prevents exploitation but disables Intel Bluetooth adapters system-wide, breaking wireless peripherals and tethering. For systems requiring Bluetooth, restricting physical and console access to trusted administrators reduces local attack surface but does not eliminate risk from compromised user accounts. Patching is the only complete remediation with no functional side effects.

More in Intel

View all

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31