CVE-2026-31393

A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component. A remote attacker could send a specially crafted, truncated L2CAP information response (L2CAP_INFO_RSP) packet. This insufficient validation of the payload length before accessing data leads to an out-of-bounds read of adjacent kernel memory. This could result in information disclosure or potentially a denial of service (DoS).

l2cap_information_rsp() read feature mask or fixed-channel bytes without ensuring cmd_len covered them. A truncated INFO_RSP with success result causes a small OOB read from the skb. The peer must reach L2CAP info exchange (typically adjacent Bluetooth).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.