Out-of-bounds read in Linux kernel Bluetooth L2CAP l2cap_ecred_data_rcv()

CVE-2026-31512 is a Linux kernel Bluetooth L2CAP flaw in the Enhanced Credit Based Flow Control data path. In l2cap_ecred_data_rcv(), the kernel reads the 2-byte SDU length field from skb->data via get_unaligned_le16() without first verifying that the socket buffer contains at least L2CAP_SDULEN_SIZE bytes. If skb->len is less than 2, the function reads past the valid end of the skb data, resulting in an out-of-bounds read. The issue was fixed by adding the same kind of length validation already used in the ERTM reassembly path, specifically ensuring sufficient data is present before reading the SDU length.