VulnerabilityPublished 22 Apr 2026Updated 5 Nov 2026

CVE-2026-31498: Linux kernel · Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in e7aab23b7df89a3d754a5f0a7d2237548b328bd0 : patch Linux kernel soon.

Data as of 5 Nov 2026, 22:19 UTC

Severity

High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in e7aab23b7df89a3d754a5f0a7d2237548b328bd0, de37e2655b7abc3f59254c6b72256840f39fc6d5, 52667c859fe33f70c2e711cb81bbd505d5eb8e75 +10

Exploitation evidence

Disclosed: evidence found.
CVE published 22 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=4.4.238 <4.5 >=4.9.238 <4.10 >=4.14.200 <4.15 >=4.19.149 <4.20 >=5.4.69 <5.5	Fixed in e7aab23b7df89a3d754a5f0a7d2237548b328bd0 de37e2655b7abc3f59254c6b72256840f39fc6d5 52667c859fe33f70c2e711cb81bbd505d5eb8e75 9760b83cfd24b38caee663f429011a0dd6064fa9 900e4db5385ec2cacd372345a80ab9c8e105b3a3 042e2cd4bb11e5313b19b87593616524949e4c52 25f420a0d4cfd61d3d23ec4b9c56d9f443d91377 9a21a631ee034b1573dce14b572a24943dbfd7ae 5.5 4.20 4.15 4.10 4.5
LinuxLinux	Affected =5.7	Fixed in–

AI-suggested

The issue is fixed in multiple Linux kernel versions including 4.20, 5.5, and others as listed in the fixedVersions. Users should upgrade to one of these fixed kernel versions to remediate the vulnerability. No additional mitigations are required once patched.

Description

A vulnerability in the Linux kernel Bluetooth L2CAP implementation could cause an infinite loop and memory exhaustion due to improper re-initialization of Enhanced Retransmission Mode (ERTM) resources and lack of validation of PDU length. This flaw has been fixed in several Linux kernel versions.

Impact

This vulnerability can lead to memory leaks and potentially cause the Bluetooth subsystem to enter an infinite loop, exhausting system memory. This could degrade system stability or cause denial of service conditions on affected Linux kernel versions.

Summary

The Linux kernel Bluetooth L2CAP code had a vulnerability where re-initializing ERTM resources on channels already in BT_CONNECTED state leaked memory by not freeing previous allocations and setting pointers to NULL improperly. Additionally, a zero value for remote_mps was not validated, leading to a zero pdu_len in l2cap_segment_sdu(), causing an infinite loop that exhausts memory. The fix involves skipping re-initialization when the channel is already connected and adding a zero check for pdu_len to prevent the infinite loop.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 22:18 UTC

Technical details

References

Community reviews

Related threats