VDB
DEBIAN-CVE-2026-31497
DEBIAN-CVE-2026-31497
PUBLISHED
CVSS 5.5 MEDIUM
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: clamp SCO altsetting table indices btusb_work() maps the number of active SCO links to USB alternate settings through a three-entry lookup table when CVSD traffic uses transparent voice settings. The lookup currently indexes alts[] with data->sco_num - 1 without first constraining sco_num to the number of available table entries. While the table only defines alternate settings for up to three SCO links, data->sco_num comes from hci_conn_num() and is used directly. Cap the lookup to the last table entry before indexing it so the driver keeps selecting the highest supported alternate setting without reading past alts[].
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | linux | 6.17.11-1, 6.13.9-1~exp1, 6.13~rc6-1~exp1 |
| Debian:13 | linux | 6.12.85-1, 6.12.74-2, 6.12.74-2 |
| Debian:11 | linux | 5.16, 6.10.6-1, 6.10.7-1 |
| Debian:11 | linux-6.1 | 6.1.106-3, 6.1.106-3, 6.1.106-3 |
| Debian:14 | linux | 6.19-1, 6.18, 6.18 |
Timeline
- Apr 22, 2026 CVE Published
- May 2, 2026 CVE Updated