CVE-2026-31497

A flaw was found in the Linux kernel's Bluetooth USB (btusb) driver. An attacker with control over Bluetooth connections could trigger an out-of-bounds read in the btusb_work() function. This occurs because the function, which maps active Synchronous Connection-Oriented (SCO) links to USB alternate settings, uses an unconstrained index when accessing an internal lookup table. This vulnerability could lead to system instability or a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.