{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.85-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.19.11-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock  btintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET and Intel exception-info retrieval) without holding hci_req_sync_lock().  This lets it race against hci_dev_do_close() -\u003e btintel_shutdown_combined(), which also runs __hci_cmd_sync() under the same lock.  When both paths manipulate hdev-\u003ereq_status/req_rsp concurrently, the close path may free the response skb first, and the still-running hw_error path hits a slab-use-after-free in kfree_skb().  Wrap the whole recovery sequence in hci_req_sync_lock/unlock so it is serialized with every other synchronous HCI command issuer.  Below is the data race report and the kasan report:    BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined    read of hdev-\u003ereq_rsp at net/bluetooth/hci_sync.c:199   by task kworker/u17:1/83:    __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200    __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223    btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254    hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030    write/free by task ioctl/22580:    btintel_shutdown_combined+0xd0/0x360     drivers/bluetooth/btintel.c:3648    hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246    hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526    BUG: KASAN: slab-use-after-free in    sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202   Read of size 4 at addr ffff888144a738dc   by task kworker/u17:1/83:    __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200    __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223    btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260",
  "id": "DEBIAN-CVE-2026-31500",
  "modified": "2026-09-14T16:47:39.985091517Z",
  "published": "2026-04-22T14:16:48.427Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-31500"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-31500"
  ]
}