Answer in brief
CVE-2026-31771 records a High severity (CVSS 8.1) vulnerability in Bluetooth: hci_event: move wake reason storage into validated event handlers. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=2f20216c1d6fe17c1a224f658be0dc6fab2269c7 <dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2 || >=2f20216c1d6fe17c1a224f658be0dc6fab2269c7 <86c8d07a64d553c41e213b52650020010f9ef23e || >=2f20216c1d6fe17c1a224f658be0dc6fab2269c7 <2b2bf47cd75518c36fa2d41380e4a40641cc89cd | dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2, 86c8d07a64d553c41e213b52650020010f9ef23e, 2b2bf47cd75518c36fa2d41380e4a40641cc89cd |
| Linux/Linuxgeneric | 5.10 | Not reported |
Published upstream
May 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: move wake reason storage into validated event handlers hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs. Rather than duplicating skb parsing and per-event length checks inside hci_store_wake_reason(), move wake-address storage into the individual event handlers after their existing event-length validation has succeeded. Convert hci_store_wake_reason() into a small helper that only stores an already-validated bdaddr while the caller holds hci_dev_lock(). Use the same helper after hci_event_func() with a NULL address to preserve the existing unexpected-wake fallback semantics when no validated event handler records a wake address. Annotate the helper with __must_hold(&hdev->lock) and add lockdep_assert_held(&hdev->lock) so future call paths keep the lock contract explicit. Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and hci_le_past_received_evt().
Quoted source text, attributed separately from HOL analysis.