CVE-2026-31497

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: clamp SCO altsetting table indices

btusb_work() maps the number of active SCO links to USB alternate settings through a three-entry lookup table when CVSD traffic uses transparent voice settings. The lookup currently indexes alts[] with data->sco_num - 1 without first constraining sco_num to the number of available table entries.

While the table only defines alternate settings for up to three SCO links, data->sco_num comes from hci_conn_num() and is used directly. Cap the lookup to the last table entry before indexing it so the driver keeps selecting the highest supported alternate setting without reading past alts[].

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626, < 312c4450fe23014665c163f480edd5ad2e27bbb8; >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626, < 9dd13a8641de79bc1bc93da55cdd35259a002683; >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626, < 476c9262b430c38c6a701a3b8176a3f48689085b; >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626, < 6fba3c3d48c927e55611a0f5ea34da88138ed0ff; >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626, < 834cf890d2c3d29cbfa1ee2376c40469c28ec297; >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626, < 1019028eb124564cf7bca58a16f1df8a1ca30726; >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626, < 21c254202f9d78abe0fcd642a92966deb92bd226; >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626, < 129fa608b6ad08b8ab7178eeb2ec272c993aaccc
LinuxLinux5.8

References

Timeline

Published
Apr 22, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-314985.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop l2caCVE-2026-314995.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() l2cap_conn_del() caCVE-2026-31508.8A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/diCVE-2026-315007.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lockCVE-2026-315019.8In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX pathCVE-2026-315027.8In the Linux kernel, the following vulnerability has been resolved: team: fix header_ops type confusion with non-Ethernet ports Similar toCVE-2026-315035.5In the Linux kernel, the following vulnerability has been resolved: udp: Fix wildcard bind conflict check when using hash2 When binding a CVE-2026-315047.8In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_relCVE-2026-315057.8In the Linux kernel, the following vulnerability has been resolved: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() iavf incorrCVE-2026-315067.8In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix double free of WoL irq We do not need to free wol_irqCVE-2026-315077.8In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pCVE-2026-315087.8In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The
CVE-2026-31497: Medium severity, CVSS 5.5 | Vulnix