--- id: CVE-2026-31772 title: 'Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync' summary: |- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on th… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cvssSource: cna cwe: - CWE-787 vendor: Linux product: Linux affected: - >- Linux >= 91d19383b7ed035e22165ae5c836e50bb9f95fbe < f5d446624345d309e7a4a1b27ea9f028d6a8c5d9 - >- Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < aba0aea354015794e8312dd7efe726967e58aefe - >- Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < eaf32002ca7b1ba51c9f140991fd9febe6de79f0 - >- Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < bc39a094730ce062fa034a529c93147c096cb488 - Linux 8958e1cee4e2eac1a5b825caa4dd96ce9ed975dd - Linux >= 6.12.2 < 6.12.81 - Linux >= 6.11.11 < 6.12 - Linux 6.13 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-10-16T15:13:07.170153Z' published: '2026-05-01' updated: '2026-10-19' sourceUpdated: '2026-10-19T19:06:08.134Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31772' references: - url: 'https://git.kernel.org/stable/c/f5d446624345d309e7a4a1b27ea9f028d6a8c5d9' - url: 'https://git.kernel.org/stable/c/aba0aea354015794e8312dd7efe726967e58aefe' - url: 'https://git.kernel.org/stable/c/eaf32002ca7b1ba51c9f140991fd9febe6de79f0' - url: 'https://git.kernel.org/stable/c/bc39a094730ce062fa034a529c93147c096cb488' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31772.json - url: 'https://access.redhat.com/security/cve/CVE-2026-31772' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2464502' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-31772' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31772' - url: >- https://lore.kernel.org/linux-cve-announce/2026050149-CVE-2026-31772-2024@gregkh/T - url: 'https://access.redhat.com/errata/RHSA-2026:83707' - url: 'https://access.redhat.com/errata/RHSA-2026:27288' - url: 'https://access.redhat.com/errata/RHSA-2026:27789' tags: - cve.org - csaf - vex - red-hat epss: 0.00142 epssPercentile: 0.03539 patched: - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_eus_v_10_0 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_9 - enterprise_linux_codeready_linux_builder_eus_v_10_0 - enterprise_linux_codeready_linux_builder_v_10 - enterprise_linux_codeready_linux_builder_v_9 - enterprise_linux_real_time_for_nfv_eus_v_10_0 - enterprise_linux_real_time_for_nfv_v_10 - enterprise_linux_real_time_for_nfv_v_9 - enterprise_linux_real_time_eus_v_10_0 - enterprise_linux_real_time_v_10 - enterprise_linux_real_time_v_9 scores: cna: 7.8 vendor: 7 ingestedAt: '2026-10-16T17:24:46.674Z' --- ## Overview In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17) BIS entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31) entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller hci_conn_big_create_sync(). When conn->num_bis is between 18 and 31, the memcpy that copies conn->bis into cp->bis writes up to 14 bytes past the stack buffer, corrupting adjacent stack memory. This is trivially reproducible: binding an ISO socket with bc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will eventually trigger hci_le_big_create_sync() from the HCI command sync worker, causing a KASAN-detectable stack-out-of-bounds write: BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0 Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71 Fix this by changing the DEFINE_FLEX count from the incorrect 0x11 to HCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that conn->bis can actually carry. ## Affected - `Linux >= 91d19383b7ed035e22165ae5c836e50bb9f95fbe < f5d446624345d309e7a4a1b27ea9f028d6a8c5d9` - `Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < aba0aea354015794e8312dd7efe726967e58aefe` - `Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < eaf32002ca7b1ba51c9f140991fd9febe6de79f0` - `Linux >= 42ecf1947135110ea08abeaca39741636f9a2285 < bc39a094730ce062fa034a529c93147c096cb488` - `Linux 8958e1cee4e2eac1a5b825caa4dd96ce9ed975dd` - `Linux >= 6.12.2 < 6.12.81` - `Linux >= 6.11.11 < 6.12` - `Linux 6.13` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:83707** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-10-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:83707) - **RHSA-2026:27288** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-06-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:27288) - **RHSA-2026:27789** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27789) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31772.json)