CVE-2026-23395

Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ

State: Published
Severity: 8.8 High
Published: Mar 25, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ

Currently the code attempts to accept requests regardless of the command identifier which may cause multiple requests to be marked as pending (FLAG_DEFER_SETUP) which can cause more than L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer causing an overflow.

The spec is quite clear that the same identifier shall not be used on subsequent requests:

'Within each signaling channel a different Identifier shall be used for each successive request or indication.' https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d

So this attempts to check if there are any channels pending with the same identifier and rejects if any are found.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
LinuxLinux	15f02b91056253e8cdc592888f431da0731337b8 to before 10a7a702542240d5edb2b39450ac951c59ccd009Affected 15f02b91056253e8cdc592888f431da0731337b8 to before 46e5b71666fb7652082e4e214a3365f4b14f1dc3Affected 15f02b91056253e8cdc592888f431da0731337b8 to before fb4a3a26483f3ea2cd21c7a2f7c45d5670600465Affected 15f02b91056253e8cdc592888f431da0731337b8 to before 2124d82fd25e1671bb3ceb37998af5aae5903e06Affected 15f02b91056253e8cdc592888f431da0731337b8 to before 6b949a6b33cbdf621d9fc6f0c48ac00915dbf514Affected 15f02b91056253e8cdc592888f431da0731337b8 to before 8d0d94f8ba5b3a0beec3b0da558b9bea48018117Affected 15f02b91056253e8cdc592888f431da0731337b8 to before e72ee455297b794b852e5cea8d2d7bb17312172aAffected 15f02b91056253e8cdc592888f431da0731337b8 to before 5b3e2052334f2ff6d5200e952f4aa66994d09899Affected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.78 through 6.12.Not affected 6.18.20 through 6.18.Not affected 6.19.10 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

15f02b91056253e8cdc592888f431da0731337b8 to before 10a7a702542240d5edb2b39450ac951c59ccd009Affected
15f02b91056253e8cdc592888f431da0731337b8 to before 46e5b71666fb7652082e4e214a3365f4b14f1dc3Affected
15f02b91056253e8cdc592888f431da0731337b8 to before fb4a3a26483f3ea2cd21c7a2f7c45d5670600465Affected
15f02b91056253e8cdc592888f431da0731337b8 to before 2124d82fd25e1671bb3ceb37998af5aae5903e06Affected
15f02b91056253e8cdc592888f431da0731337b8 to before 6b949a6b33cbdf621d9fc6f0c48ac00915dbf514Affected
15f02b91056253e8cdc592888f431da0731337b8 to before 8d0d94f8ba5b3a0beec3b0da558b9bea48018117Affected
15f02b91056253e8cdc592888f431da0731337b8 to before e72ee455297b794b852e5cea8d2d7bb17312172aAffected
15f02b91056253e8cdc592888f431da0731337b8 to before 5b3e2052334f2ff6d5200e952f4aa66994d09899Affected

LinuxLinux

5.7Affected
before 5.7Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.78 through 6.12.*Not affected
6.18.20 through 6.18.*Not affected
6.19.10 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.