Linux Kernel CVE-2026-31771

Requires target system running vulnerable Linux kernel version 5.10 through 6.19.11 with Bluetooth subsystem loaded and enabled. Attacker must achieve adjacent network access by being within Bluetooth radio range of the target device, typically 10-100 meters depending on Bluetooth class (Class 1 devices up to 100m, Class 2 up to 10m). Bluetooth controller must be discoverable or attacker must know device MAC address for directed transmission. No authentication, user interaction, or special Bluetooth pairing required due to vulnerability residing in pre-authentication HCI event handling. Not exploitable remotely over IP networks. Exploitation limited by Bluetooth protocol timing and frame rate constraints. Default Bluetooth-enabled configurations are vulnerable; systems with Bluetooth disabled via kernel module blacklist or hardware killswitch are not affected.

CVSS 8.1 (High) reflects adjacent network attack vector requiring no authentication or user interaction with high confidentiality and availability impact. However, real-world risk is moderate rather than critical based on multiple limiting factors. EPSS exploitation probability is very low (0.02%, 6th percentile), indicating security researchers and threat actors have not prioritized this vulnerability. No CISA KEV listing confirms lack of observed exploitation in the wild. The adjacent network attack vector (AV:A) requires attacker presence on the same Bluetooth broadcast domain, substantially reducing exposure compared to remote internet-facing vulnerabilities. Attack complexity is low (AC:L) once adjacent access is achieved, but the Bluetooth proximity requirement and need to craft malformed HCI frames limits scalability. Information disclosure impact enables kernel memory leaks potentially containing sensitive data, while availability impact could trigger kernel crashes. Patch availability across all supported kernel versions since 5.10 provides clear remediation path. Priority should be moderate for systems with Bluetooth enabled in untrusted physical environments (public spaces, enterprise with guest access), but lower for air-gapped or Bluetooth-disabled systems. The vulnerability requires kernel Bluetooth subsystem to be loaded and actively processing HCI events.

Attacker positions themselves within Bluetooth range (typically 10-100 meters depending on device class) of a target Linux system with Bluetooth enabled. Using commodity Bluetooth development hardware or software-defined radio, attacker transmits crafted HCI event frames with truncated payloads to the victim's Bluetooth controller. The malformed frames bypass length validation in hci_event_packet() and trigger out-of-bounds memory access in bacpy() during wake reason processing. This leaks adjacent kernel memory contents back to the attacker through timing side channels or error responses, potentially exposing cryptographic keys, process data, or kernel addresses useful for ASLR bypass. Repeated exploitation could crash the Bluetooth stack or kernel, causing denial of service.