CVE-2026-31498

A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation. A remote attacker could exploit this by sending a malformed configuration request with a zero-valued maximum PDU (Protocol Data Unit) size. This could lead to an infinite loop, exhausting system memory and causing a denial of service. Additionally, improper handling of channel reconfiguration could result in memory leaks.

Upstream prevents double ERTM initialization on reconfigure and rejects zero pdu_len segmentation loops. Red Hat advises treating Bluetooth attack surface as locally/physically proximate in most deployments; still consume patched kernels. Unloading the Bluetooth stack removes exposure where RF is unused.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the bluetooth module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.