CVE-2026-31771

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: move wake reason storage into validated event handlers

hci_store_wake_reason() is called from hci_event_packet() immediately

after stripping the HCI event header but before hci_event_func()

enforces the per-event minimum payload length from hci_ev_table.

This means a short HCI event frame can reach bacpy() before any bounds

check runs.

Rather than duplicating skb parsing and per-event length checks inside

hci_store_wake_reason(), move wake-address storage into the individual

event handlers after their existing event-length validation has

succeeded. Convert hci_store_wake_reason() into a small helper that only

stores an already-validated bdaddr while the caller holds hci_dev_lock().

Use the same helper after hci_event_func() with a NULL address to

preserve the existing unexpected-wake fallback semantics when no

validated event handler records a wake address.

Annotate the helper with __must_hold

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References