Bluetooth: hci_event: move wake reason storage into validated event handlers

Finding IDs

F-TORVALDS-LINUX-BT-HCI-001

CVE

CVE-2026-31771

Status

patched

Fixed in

Linux 7.0; stable backports listed in the CNA record; mainline 2b2bf47cd75518c36fa2d41380e4a40641cc89cd

Recorded credit

Upstream commit author and Signed-off-by: Oleh Konko / 1seal; no credit field in the Linux CNA record.

Disclosure date

1 May 2026

Note

CNA record verified PUBLISHED on 2026-09-23 and matched to the exact mainline fix. Upstream authorship source: https://github.com/torvalds/linux/commit/2b2bf47cd75518c36fa2d41380e4a40641cc89cd. Score is the current Linux CNA CVSS v3.1, not a revision of the original report assessment.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CVE registry state

PUBLISHED

CVE state checked

23 Sep 2026

F-TORVALDS-LINUX-BT-HCI-001: Memory safety. HCI event handling lacks required buffer bounds validation. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.

Mechanism source for F-TORVALDS-LINUX-BT-HCI-001

Security area (1seal assessment): Memory safety. HCI event handling lacks required buffer bounds validation. Reviewed 24 Sep 2026.

• Source: www.cve.org (external) ↗
• F-TORVALDS-LINUX-BT-HCI-001
• CVE publication state
• CVE-2026-31771 CNA record
• Classification source

Finding IDs

F-TORVALDS-LINUX-BT-HCI-001

CVE

CVE-2026-31771

Status

merged

Reported via

bluetooth maintainers

Note

accepted into bluetooth-next: 3e7e7f4bdbe5. short HCI event frames could reach bacpy() before per-event minimum-length validation.

F-TORVALDS-LINUX-BT-HCI-001: Memory safety. HCI event handling lacks required buffer bounds validation. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.

Mechanism source for F-TORVALDS-LINUX-BT-HCI-001

Security area (1seal assessment): Memory safety. HCI event handling lacks required buffer bounds validation. Reviewed 24 Sep 2026.

• Source: github.com (external) ↗
• F-TORVALDS-LINUX-BT-HCI-001
• CVE-2026-31771 CNA record
• Classification source