https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 19:27:39 +0000 https://vulnerability.circl.lu/vuln/cve-2026-31512 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()</p> <p>l2cap_ecred_data_rcv() reads the SDU length field from skb-&gt;data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb-&gt;len is less than 2, this reads past the valid data in the skb.</p> <p>The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()</p> <p>l2cap_ecred_data_rcv() reads the SDU length field from skb-&gt;data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb-&gt;len is less than 2, this reads past the valid data in the skb.</p> <p>The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.</p> https://vulnerability.circl.lu/vuln/cve-2026-31512