CVE-2026-31512None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_un…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb.
The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.
Linux >= aac23bf636593cc2d67144aed373a46a1a5f76b1 < cef09691cfb61f6c91cc27c3d69634f81c8ab949Linux >= aac23bf636593cc2d67144aed373a46a1a5f76b1 < 3340be2bafdcc806f048273ea6d8e82a6597aa1bLinux >= aac23bf636593cc2d67144aed373a46a1a5f76b1 < e47315b84d0eb188772c3ff5cf073cdbdefca6b4Linux >= aac23bf636593cc2d67144aed373a46a1a5f76b1 < 477ad4976072056c348937e94f24583321938df4Linux >= aac23bf636593cc2d67144aed373a46a1a5f76b1 < 40c7f7eea2f4d9cb0b3e924254c8c9053372168fLinux >= aac23bf636593cc2d67144aed373a46a1a5f76b1 < 8c96f3bd4ae0802db90630be8e9851827e9c9209Linux >= aac23bf636593cc2d67144aed373a46a1a5f76b1 < 5ad981249be52f5e4e92e0e97b436b569071cb86Linux >= aac23bf636593cc2d67144aed373a46a1a5f76b1 < c65bd945d1c08c3db756821b6bf9f1c4a77b29c6Linux 3.14Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses