{"id":"CVE-2026-31771","summary":"Bluetooth: hci_event: move wake reason storage into validated event handlers","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the HCI event header but before hci_event_func()\nenforces the per-event minimum payload length from hci_ev_table.\nThis means a short HCI event frame can reach bacpy() before any bounds\ncheck runs.\n\nRather than duplicating skb parsing and per-event length checks inside\nhci_store_wake_reason(), move wake-address storage into the individual\nevent handlers after their existing event-length validation has\nsucceeded. Convert hci_store_wake_reason() into a small helper that only\nstores an already-validated bdaddr while the caller holds hci_dev_lock().\nUse the same helper after hci_event_func() with a NULL address to\npreserve the existing unexpected-wake fallback semantics when no\nvalidated event handler records a wake address.\n\nAnnotate the helper with __must_hold(&hdev-\u003elock) and add\nlockdep_assert_held(&hdev-\u003elock) so future call paths keep the lock\ncontract explicit.\n\nCall the helper from hci_conn_request_evt(), hci_conn_complete_evt(),\nhci_sync_conn_complete_evt(), le_conn_complete_evt(),\nhci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),\nhci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and\nhci_le_past_received_evt().","modified":"2026-11-01T02:30:22.799194913Z","published":"2026-05-01T14:14:59.918Z","related":["SUSE-SU-2026:22433-1","SUSE-SU-2026:22436-1","SUSE-SU-2026:22458-1","SUSE-SU-2026:22460-1","SUSE-SU-2026:22742-1","SUSE-SU-2026:22769-1","SUSE-SU-2026:22812-1","SUSE-SU-2026:22835-1","SUSE-SU-2026:2632-1","SUSE-SU-2026:2799-1","SUSE-SU-2026:2800-1","SUSE-SU-2026:2840-1","SUSE-SU-2026:2841-1","SUSE-SU-2026:3044-1","SUSE-SU-2026:3089-1","openSUSE-SU-2026:21388-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31771.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1e4b738dd0d0f7b237686167706badad9d30649c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2b2bf47cd75518c36fa2d41380e4a40641cc89cd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/86c8d07a64d553c41e213b52650020010f9ef23e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ac7889b0fe441e4ef892c40b1d002e91f93fa4ae"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fbea63d0d301edd4a42f4390b49b8519d78b802d"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31771.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31771"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7"},{"fixed":"fbea63d0d301edd4a42f4390b49b8519d78b802d"},{"fixed":"1e4b738dd0d0f7b237686167706badad9d30649c"},{"fixed":"ac7889b0fe441e4ef892c40b1d002e91f93fa4ae"},{"fixed":"dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2"},{"fixed":"86c8d07a64d553c41e213b52650020010f9ef23e"},{"fixed":"2b2bf47cd75518c36fa2d41380e4a40641cc89cd"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31771.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.10.0"},{"fixed":"6.1.191"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.114"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.57"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.12"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31771.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}]}