Skip to main content

Linux Kernel EUVDEUVD-2026-24870

| CVE-2026-31497 MEDIUM
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-5324-g7qj-pjfx
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Apr 28, 2026 - 14:52 vuln.today
CVSS changed
Apr 28, 2026 - 14:52 NVD
5.5 (MEDIUM)
Patch released
Apr 28, 2026 - 14:42 nvd
Patch available
Patch available
Apr 22, 2026 - 16:33 EUVD
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24870
Analysis Generated
Apr 22, 2026 - 14:22 vuln.today
CVE Published
Apr 22, 2026 - 14:16 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: clamp SCO altsetting table indices

btusb_work() maps the number of active SCO links to USB alternate settings through a three-entry lookup table when CVSD traffic uses transparent voice settings. The lookup currently indexes alts[] with data->sco_num - 1 without first constraining sco_num to the number of available table entries.

While the table only defines alternate settings for up to three SCO links, data->sco_num comes from hci_conn_num() and is used directly. Cap the lookup to the last table entry before indexing it so the driver keeps selecting the highest supported alternate setting without reading past alts[].

AnalysisAI

Out-of-bounds array access in the btusb driver's Bluetooth SCO link handling allows local authenticated attackers to cause denial of service by exhausting kernel memory or crashing the Bluetooth subsystem. The btusb_work() function fails to constrain the sco_num variable before indexing a three-entry lookup table, permitting reads and potential writes past allocated buffer boundaries when four or more SCO links are active. This affects Linux kernel versions 5.8 through 7.0-rc2 and requires local access with unprivileged user privileges to trigger.

Technical ContextAI

The vulnerability exists in the Linux kernel's Bluetooth USB (btusb) driver module, specifically in the btusb_work() function responsible for managing USB alternate settings for Synchronous Connection-Oriented (SCO) traffic. SCO links are used in Bluetooth for voice and audio transmission. The driver uses a transparent voice setting mode with a fixed three-element lookup table (alts[]) that maps the number of active SCO connections (0-3) to appropriate USB alternate settings. The function retrieves the active SCO count via hci_conn_num() without validating it against the table size. When SCO connections exceed three, the array index calculation (data->sco_num - 1) produces out-of-bounds memory access. The CWE classification (Information Disclosure per tags) suggests potential data leak, though denial of service is the primary impact vector. This is a classic buffer over-read vulnerability in kernel device driver code.

RemediationAI

Update the Linux kernel to patched versions: 5.10.253 or later (5.10 series), 5.15.203 or later (5.15 series), 6.1.168 or later (6.1 series), 6.6.131 or later (6.6 series), 6.12.80 or later (6.12 series), 6.18.21 or later (6.18 series), 6.19.11 or later (6.19 series), or 7.0 final release. The fix is available in all stable branch commits referenced in the NVD entry. For systems unable to patch immediately, disable Bluetooth USB functionality at the driver level using modprobe blacklist (add 'blacklist btusb' to /etc/modprobe.d/blacklist.conf) if Bluetooth is not required; this eliminates the attack surface but removes Bluetooth USB adapter support until the driver is re-enabled. Alternatively, restrict unprivileged user access to Bluetooth sockets and HCI interfaces via AppArmor, SELinux, or udev permission rules if partial Bluetooth functionality is needed. Note that these workarounds prevent legitimate Bluetooth use and should be treated as temporary measures pending kernel updates.

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-24870 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy