---
id: CVE-2026-31497
title: 'Bluetooth: btusb: clamp SCO altsetting table indices'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: btusb: clamp SCO altsetting table indices

  btusb_work() maps the number of active SCO links to USB alternate
  settings through a three-entry lookup table when…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 <
    312c4450fe23014665c163f480edd5ad2e27bbb8
  - >-
    Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 <
    9dd13a8641de79bc1bc93da55cdd35259a002683
  - >-
    Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 <
    476c9262b430c38c6a701a3b8176a3f48689085b
  - >-
    Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 <
    6fba3c3d48c927e55611a0f5ea34da88138ed0ff
  - >-
    Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 <
    834cf890d2c3d29cbfa1ee2376c40469c28ec297
  - >-
    Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 <
    1019028eb124564cf7bca58a16f1df8a1ca30726
  - >-
    Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 <
    21c254202f9d78abe0fcd642a92966deb92bd226
  - >-
    Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 <
    129fa608b6ad08b8ab7178eeb2ec272c993aaccc
  - Linux 5.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:35:36.640404Z'
published: '2026-04-22'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:45:02.895Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31497'
references:
  - url: 'https://git.kernel.org/stable/c/312c4450fe23014665c163f480edd5ad2e27bbb8'
  - url: 'https://git.kernel.org/stable/c/9dd13a8641de79bc1bc93da55cdd35259a002683'
  - url: 'https://git.kernel.org/stable/c/476c9262b430c38c6a701a3b8176a3f48689085b'
  - url: 'https://git.kernel.org/stable/c/6fba3c3d48c927e55611a0f5ea34da88138ed0ff'
  - url: 'https://git.kernel.org/stable/c/834cf890d2c3d29cbfa1ee2376c40469c28ec297'
  - url: 'https://git.kernel.org/stable/c/1019028eb124564cf7bca58a16f1df8a1ca30726'
  - url: 'https://git.kernel.org/stable/c/21c254202f9d78abe0fcd642a92966deb92bd226'
  - url: 'https://git.kernel.org/stable/c/129fa608b6ad08b8ab7178eeb2ec272c993aaccc'
tags:
  - cve.org
epss: 0.00123
epssPercentile: 0.02048
ingestedAt: '2026-11-05T23:41:31.984Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: clamp SCO altsetting table indices

btusb_work() maps the number of active SCO links to USB alternate
settings through a three-entry lookup table when CVSD traffic uses
transparent voice settings. The lookup currently indexes alts[] with
data->sco_num - 1 without first constraining sco_num to the number of
available table entries.

While the table only defines alternate settings for up to three SCO
links, data->sco_num comes from hci_conn_num() and is used directly.
Cap the lookup to the last table entry before indexing it so the
driver keeps selecting the highest supported alternate setting without
reading past alts[].

## Affected

- `Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 < 312c4450fe23014665c163f480edd5ad2e27bbb8`
- `Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 < 9dd13a8641de79bc1bc93da55cdd35259a002683`
- `Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 < 476c9262b430c38c6a701a3b8176a3f48689085b`
- `Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 < 6fba3c3d48c927e55611a0f5ea34da88138ed0ff`
- `Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 < 834cf890d2c3d29cbfa1ee2376c40469c28ec297`
- `Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 < 1019028eb124564cf7bca58a16f1df8a1ca30726`
- `Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 < 21c254202f9d78abe0fcd642a92966deb92bd226`
- `Linux >= baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 < 129fa608b6ad08b8ab7178eeb2ec272c993aaccc`
- `Linux 5.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.