{"id":"CVE-2026-31772","title":"Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync\n\nhci_le_big_create_sync() uses DEFINE_FLEX to allocate a\nstruct hci_cp_le_big_create_sync on th…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Linux","product":"Linux","affected":["Linux >= 91d19383b7ed035e22165ae5c836e50bb9f95fbe < f5d446624345d309e7a4a1b27ea9f028d6a8c5d9","Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < aba0aea354015794e8312dd7efe726967e58aefe","Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < eaf32002ca7b1ba51c9f140991fd9febe6de79f0","Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < bc39a094730ce062fa034a529c93147c096cb488","Linux 8958e1cee4e2eac1a5b825caa4dd96ce9ed975dd","Linux >= 6.12.2 < 6.12.81","Linux >= 6.11.11 < 6.12","Linux 6.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:13:07.170153Z"},"published":"2026-05-01","updated":"2026-10-19","sourceUpdated":"2026-10-19T19:06:08.134Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31772","references":[{"url":"https://git.kernel.org/stable/c/f5d446624345d309e7a4a1b27ea9f028d6a8c5d9"},{"url":"https://git.kernel.org/stable/c/aba0aea354015794e8312dd7efe726967e58aefe"},{"url":"https://git.kernel.org/stable/c/eaf32002ca7b1ba51c9f140991fd9febe6de79f0"},{"url":"https://git.kernel.org/stable/c/bc39a094730ce062fa034a529c93147c096cb488"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31772.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-31772"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464502"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31772"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31772"},{"url":"https://lore.kernel.org/linux-cve-announce/2026050149-CVE-2026-31772-2024@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:83707"},{"url":"https://access.redhat.com/errata/RHSA-2026:27288"},{"url":"https://access.redhat.com/errata/RHSA-2026:27789"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00142,"epssPercentile":0.03539,"patched":["enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_eus_v_10_0","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_eus_v_10_0","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_real_time_for_nfv_eus_v_10_0","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_eus_v_10_0","enterprise_linux_real_time_v_10","enterprise_linux_real_time_v_9"],"scores":{"cna":7.8,"vendor":7},"ingestedAt":"2026-10-16T17:24:46.674Z","slug":"CVE-2026-31772","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync\n\nhci_le_big_create_sync() uses DEFINE_FLEX to allocate a\nstruct hci_cp_le_big_create_sync on the stack with room for 0x11 (17)\nBIS entries.  However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31)\nentries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller\nhci_conn_big_create_sync().  When conn->num_bis is between 18 and 31,\nthe memcpy that copies conn->bis into cp->bis writes up to 14 bytes\npast the stack buffer, corrupting adjacent stack memory.\n\nThis is trivially reproducible: binding an ISO socket with\nbc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will\neventually trigger hci_le_big_create_sync() from the HCI command\nsync worker, causing a KASAN-detectable stack-out-of-bounds write:\n\n  BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0\n  Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71\n\nFix this by changing the DEFINE_FLEX count from the incorrect 0x11 to\nHCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that\nconn->bis can actually carry.\n\n## Affected\n\n- `Linux >= 91d19383b7ed035e22165ae5c836e50bb9f95fbe < f5d446624345d309e7a4a1b27ea9f028d6a8c5d9`\n- `Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < aba0aea354015794e8312dd7efe726967e58aefe`\n- `Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < eaf32002ca7b1ba51c9f140991fd9febe6de79f0`\n- `Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < bc39a094730ce062fa034a529c93147c096cb488`\n- `Linux 8958e1cee4e2eac1a5b825caa4dd96ce9ed975dd`\n- `Linux >= 6.12.2 < 6.12.81`\n- `Linux >= 6.11.11 < 6.12`\n- `Linux 6.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:83707** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-10-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:83707)\n- **RHSA-2026:27288** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-06-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:27288)\n- **RHSA-2026:27789** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27789)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31772.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":225122,"id":"CVE-2026-31772","ts":1792438790917,"field":"cvss","old":"7","new":"7.8"},{"seq":223806,"id":"CVE-2026-31772","ts":1792238435660,"field":"cvss","old":"7.8","new":"7"}]}