In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: move wake reason storage into validated event handlers hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs. Rather than duplicating skb parsing and per-event length checks inside hci_store_wake_reason(), move wake-address storage into the individual event handlers after their existing event-length validation has succeeded. Convert hci_store_wake_reason() into a small helper that only stores an already-validated bdaddr while the caller holds hci_dev_lock(). Use the same helper after hci_event_func() with a NULL address to preserve the existing unexpected-wake fallback semantics when no validated event handler records a wake address. Annotate the helper with __must_hold(&hdev->lock) and add lockdep_assert_held(&hdev->lock) so future call paths keep the lock contract explicit. Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and hci_le_past_received_evt().

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2632-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
    - CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
    - CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
    - CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
    - CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
    - CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed     (bsc#1263880).
    - CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
    - CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
    - CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers     (bsc#1264145).
    - CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).
    - CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).
    - CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
    - CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
    - CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).
    - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
    - CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
    - CVE-2026-45984: gfs2: Move the inode glock locking to gfs2_file_buffered_write (bsc#1267214).
    - CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).
    - CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
    - CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267640).
    - CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).
    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).
    - CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (bsc#1267663).
    - CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).
    - CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1265211 bsc#1267651).

    The following non security issues were fixed:

    - bnxt_en: Fix NULL pointer dereference (bsc#1268307).
    - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).
    - ethtool: provide customized dim profile management (bsc#1261256).
    - hv: utils: handle and propagate errors in kvp_register (git-fixes).
    - hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).
    - linux/dim: move useful macros to .h file (bsc#1261256).
    - net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).
    - net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).
    - net: mana: Add support for RX CQE Coalescing (bsc#1261256).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: hci_event: move wake reason storage into validated event handlers hci_store_wake_reason() is     called from hci_event_packet() immediately after stripping the HCI event header but before     hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI     event frame can reach bacpy() before any bounds check runs. Rather than duplicating skb parsing and per-     event length checks inside hci_store_wake_reason(), move wake-address storage into the individual event     handlers after their existing event-length validation has succeeded. Convert hci_store_wake_reason() into     a small helper that only stores an already-validated bdaddr while the caller holds hci_dev_lock(). Use the     same helper after hci_event_func() with a NULL address to preserve the existing unexpected-wake fallback     semantics when no validated event handler records a wake address. Annotate the helper with
    __must_hold(&hdev->lock) and add lockdep_assert_held(&hdev->lock) so future call paths keep the lock     contract explicit. Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(),     hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(),     hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and     hci_le_past_received_evt(). (CVE-2026-31771)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323031	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2632-1)	Nessus	SuSE Local Security Checks	high
311693	Linux Distros Unpatched Vulnerability : CVE-2026-31771	Nessus	Misc.	high

Detections

Analytics

CVE-2026-31771

high

Tenable Plugins

high

high