CVE-2026-31497

OVERVIEW CVE-2026-31497 is a buffer index validation vulnerability in the Linux kernel's Bluetooth USB driver (btusb). The vulnerability exists in the btusb_work() function, which maps active SCO (Synchronous Connection-Oriented) links to USB alternate settings without properly validating the lookup table index. When processing CVSD traffic with transparent voice settings, the driver uses the SCO link count directly as a table index without constraining it to the three available entries, potentially causing out-of-bounds table access. SEVERITY The vulnerability carries a low to moderate risk profile with a CVSS score not yet assigned and an EPSS score of 0.00024, indicating minimal exploitation likelihood. The defect involves direct memory access without bounds checking on the Bluetooth subsystem, which typically requires local system access or a connected Bluetooth device to exploit. The impact is constrained by the three-entry lookup table limitation and the specific conditions required to trigger excessive SCO link counts, reducing both attack complexity and practical exploitability. EXPLOITATION STATUS The vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active real-world exploitation. No public exploit code is documented, and community attention remains limited given the low EPSS score and specific technical requirements for triggering the flaw. The fix has been implemented in the Linux kernel repository through index clamping, making exploitation unlikely in patched systems.