Out-of-Bounds Write in Linux kernel (CVE-2026-31772, CVSS 7.8)

Summary

Out-of-bounds write in Linux kernel (CVE-2026-31772). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

hci_le_big_create_sync() uses DEFINE_FLEX to allocate a
struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17)
BIS entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31)
entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller
hci_conn_big_create_sync(). When conn->num_bis is between 18 and 31,
the memcpy that copies conn->bis into cp->bis writes up to 14 bytes
past the stack buffer, corrupting adjacent stack memory.

This is trivially reproducible: binding an ISO socket with
bc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will
eventually trigger hci_le_big_create_sync() from the HCI command
sync worker, causing a KASAN-detectable stack-out-of-bounds write:

BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0
Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71

Fix this by changing the DEFINE_FLEX count from the incorrect 0x11 to
HCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that
conn->bis can actually carry.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

Linuxカーネル内において、hci_le_big_create_sync関数におけるスタックバッファオーバーフローの脆弱性が修正されました。この脆弱性は、Bluetoothの同期機能に関するもので、特定の条件下でスタックメモリを越えてデータが書き込まれ、メモリが破損する可能性がありました。この問題は修正され、現在は安全な使用が保障されています。

❓ What is the problem

LinuxカーネルのBluetooth同期機能のバッファオーバーフロー脆弱性。

📍 Affected scope

Linuxカーネルのhci_le_big_create_sync関数。

🔥 Severity

スタックバッファオーバーフローによるメモリ破損の可能性があり、高リスク。

🔧 How to fix

DEFINE_FLEXのカウントを0x11からHCI_MAX_ISO_BISに変更。

🛡️ Workaround

情報なし

🔍 Detection

KASANでのスタックオーバーフロー検出による確認が可能。

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.81"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.22"},{"fixed":"6.19.12"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2026-31772 linux-lts Fixed in: 6.18.35-r1
Debian DEBIAN-CVE-2026-31772 linux Fixed in: 6.12.85-1
Ubuntu UBUNTU-CVE-2026-31772 linux-hwe-edge

Out-of-Bounds Write in Linux kernel (CVE-2026-31772)

Summary

Original description

AI summary

Affected packages

Fix status by distribution

References