CVE-2026-31771

A flaw was found in the Linux kernel's Bluetooth subsystem. A remote attacker could exploit a missing bounds check by sending a specially crafted, short Bluetooth Host Controller Interface (HCI) event frame. This could lead to a buffer overflow, potentially allowing the attacker to cause a denial of service or execute arbitrary code.

Bluetooth HCI event parsing now stores wake reasons only from validated handlers, avoiding out-of-band writes on unexpected event codes. Red Hat recommends patched kernels for Bluetooth stacks; unload bluetooth where RF is unused.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the bluetooth module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.