VulnerabilityPublished 22 Apr 2026Updated 5 Nov 2026

CVE-2026-31500: Linux kernel · Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f7d84737663ad4a120d2d8ef1561a4df91282c2e : patch Linux kernel soon.

Data as of 5 Nov 2026, 22:19 UTC

Severity

High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in f7d84737663ad4a120d2d8ef1561a4df91282c2e, e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5, 66696648af477dc87859e5e4b607112f5f29d010 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 22 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 973bb97e5aee56edddaae3d5c96877101ad509c0, < f7d84737663ad4a120d2d8ef1561a4df91282c2e	Fixed in f7d84737663ad4a120d2d8ef1561a4df91282c2e
LinuxLinux	Affected ≥ 973bb97e5aee56edddaae3d5c96877101ad509c0, < e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5	Fixed in e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5
LinuxLinux	Affected ≥ 973bb97e5aee56edddaae3d5c96877101ad509c0, < 66696648af477dc87859e5e4b607112f5f29d010	Fixed in 66696648af477dc87859e5e4b607112f5f29d010
LinuxLinux	Affected ≥ 973bb97e5aee56edddaae3d5c96877101ad509c0, < 94d8e6fe5d0818e9300e514e095a200bd5ff93ae	Fixed in 94d8e6fe5d0818e9300e514e095a200bd5ff93ae
LinuxLinux	Affected ≥ 973bb97e5aee56edddaae3d5c96877101ad509c0, < 7e041d0aad1d4d43d921ace052e04f4e2cacaed3	Fixed in 7e041d0aad1d4d43d921ace052e04f4e2cacaed3
LinuxLinux	Affected ≥ 973bb97e5aee56edddaae3d5c96877101ad509c0, < 5f84e845648dfa86e42de5487f1a774b42f0444d	Fixed in 5f84e845648dfa86e42de5487f1a774b42f0444d

AI-suggested

A fix is available and has been applied in the Linux kernel. Users should update to a fixed kernel version containing the patches identified by the commit hashes provided. No additional mitigation is required once the kernel is updated.

Description

CVE-2026-31500 is a Linux kernel Bluetooth vulnerability involving a race condition in the btintel driver. The function btintel_hw_error() issues synchronous HCI commands without proper locking, causing a race with the device close path that can lead to a use-after-free error. This flaw can cause kernel memory corruption due to concurrent manipulation of request status and response pointers. The issue has been fixed by serializing the recovery sequence with the appropriate lock to prevent concurrent access.

Impact

This vulnerability can cause a kernel slab-use-after-free, leading to potential kernel memory corruption or instability. While no direct exploitation or remote code execution is confirmed, such memory corruption in kernel space can cause system crashes or unpredictable behavior.

Summary

In the Linux kernel Bluetooth subsystem, the btintel driver function btintel_hw_error() calls __hci_cmd_sync() twice without holding the hci_req_sync_lock, allowing a race condition with hci_dev_do_close() which also uses __hci_cmd_sync() under the same lock. This race leads to concurrent manipulation of hdev->req_status and hdev->req_rsp, where the close path may free the response skb before the hw_error path finishes using it, resulting in a slab-use-after-free detected by KASAN. The fix involves wrapping the entire recovery sequence in hci_req_sync_lock/unlock to serialize synchronous HCI command issuers and prevent the race.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 22:18 UTC

Technical details

References

Community reviews

Related threats