CVE-2026-31772

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stack buffer overflow exists in the hci le big create sync() function. The function uses DEFINE FLEX to allocate a struct hci cp le big create sync on the stack with space for 17 BIS entries. However, the conn->num bis variable can hold up to 31 entries. When conn->num bis is between 18 and 31, a memcpy operation copying conn->bis into cp->bis writes up to 14 bytes beyond the stack buffer, leading to corruption of adjacent stack memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.