CVE-2026-31772

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

hci_le_big_create_sync() uses DEFINE_FLEX to allocate a

struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17)

BIS entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31)

entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller

hci_conn_big_create_sync(). When conn->num_bis is between 18 and 31,

the memcpy that copies conn->bis into cp->bis writes up to 14 bytes

past the stack buffer, corrupting adjacent stack memory.

This is trivially reproducible: binding an ISO socket with

bc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will

eventually trigger hci_le_big_create_sync() from the HCI command

sync worker, causing a KASAN-detectable stack-out-of-bounds write:

BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0

Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71

Fix

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References