{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"312c4450fe23014665c163f480edd5ad2e27bbb8","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"9dd13a8641de79bc1bc93da55cdd35259a002683","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"476c9262b430c38c6a701a3b8176a3f48689085b","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"6fba3c3d48c927e55611a0f5ea34da88138ed0ff","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"834cf890d2c3d29cbfa1ee2376c40469c28ec297","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"1019028eb124564cf7bca58a16f1df8a1ca30726","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"21c254202f9d78abe0fcd642a92966deb92bd226","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"129fa608b6ad08b8ab7178eeb2ec272c993aaccc","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-31497","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: clamp SCO altsetting table indices\n\nbtusb_work() maps the number of active SCO links to USB alternate\nsettings through a three-entry lookup table when CVSD traffic uses\ntransparent voice settings. The lookup currently indexes alts[] with\ndata->sco_num - 1 without first constraining sco_num to the number of\navailable table entries.\n\nWhile the table only defines alternate settings for up to three SCO\nlinks, data->sco_num comes from hci_conn_num() and is used directly.\nCap the lookup to the last table entry before indexing it so the\ndriver keeps selecting the highest supported alternate setting without\nreading past alts[].","epss":{"date":"2026-11-05","percentile":0.02051,"score":0.00123},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793915102895,"publishedAt":1776866059051,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/312c4450fe23014665c163f480edd5ad2e27bbb8"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/9dd13a8641de79bc1bc93da55cdd35259a002683"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/476c9262b430c38c6a701a3b8176a3f48689085b"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/6fba3c3d48c927e55611a0f5ea34da88138ed0ff"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/834cf890d2c3d29cbfa1ee2376c40469c28ec297"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/1019028eb124564cf7bca58a16f1df8a1ca30726"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/21c254202f9d78abe0fcd642a92966deb92bd226"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/129fa608b6ad08b8ab7178eeb2ec272c993aaccc"}],"remediation":[],"revision":"d2f20c6134c7b275ea016459f1ee78532d2589f9cf1d28a3f8def8ae320ae6bc","sources":[{"modifiedAt":1793915102895,"name":"CNA: Linux","retrievedAt":1793917068094,"url":"https://www.cve.org/CVERecord?id=CVE-2026-31497"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793917073471,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31497"}],"ssvc":{"assessedAt":1793914536640,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Bluetooth: btusb: clamp SCO altsetting table indices","updatedAt":1793917073471}