CVE-2026-31513

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2capecredconn_req

Syzbot reported a KASAN stack-out-of-bounds read in l2capbuildcmd() that is triggered by a malformed Enhanced Credit Based Connection Request.

The vulnerability stems from l2capecredconnreq(). The function allocates a local stack buffer (pdu) designed to hold a maximum of 5 Source Channel IDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more than 5 SCIDs, the function calculates rsp_len based on this unvalidated cmd_len before checking if the number of SCIDs exceeds L2CAPECREDMAXCID.

If the SCID count is too high, the function correctly jumps to the response label to reject the packet, but rsp_len retains the attacker's oversized value. Consequently, l2capsendcmd() is instructed to read past the end of the 18-byte pdu buffer, triggering a KASAN panic.

Fix this by moving the assignment of rsp_len to after the num_scid boundary check. If the packet is rejected, rsp_len will safely remain 0, and the error response will only read the 8-byte base header from the stack.