CVE-2026-63976

Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

State: Published
Severity: 8.8 High
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value.

A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET).

Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-694 Use of Multiple Resources with Duplicate Identifier

Affected Products

Product	Versions
LinuxLinux	15f02b91056253e8cdc592888f431da0731337b8 to before 59f5ecf6ad5c4db6ae81965a96156954a3b0d89aAffected 15f02b91056253e8cdc592888f431da0731337b8 to before ae0152d77d101c920769934fb102b18de0c6f526Affected 15f02b91056253e8cdc592888f431da0731337b8 to before c2afd2613fda90107c5e2fe8e855627451749c78Affected 15f02b91056253e8cdc592888f431da0731337b8 to before cc2b4f749de09975bfa06e58bbbad2f6acd4c79cAffected 15f02b91056253e8cdc592888f431da0731337b8 to before 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1Affected 15f02b91056253e8cdc592888f431da0731337b8 to before f39049304ba655ffcbb92edbdf8c51a1f1210bedAffected 15f02b91056253e8cdc592888f431da0731337b8 to before 8e7977afaef37c6bd2b2654f1bce6ab40d471147Affected 15f02b91056253e8cdc592888f431da0731337b8 to before 00e1950716c6ed67d74777b2db286b0fa23b4be9Affected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

15f02b91056253e8cdc592888f431da0731337b8 to before 59f5ecf6ad5c4db6ae81965a96156954a3b0d89aAffected
15f02b91056253e8cdc592888f431da0731337b8 to before ae0152d77d101c920769934fb102b18de0c6f526Affected
15f02b91056253e8cdc592888f431da0731337b8 to before c2afd2613fda90107c5e2fe8e855627451749c78Affected
15f02b91056253e8cdc592888f431da0731337b8 to before cc2b4f749de09975bfa06e58bbbad2f6acd4c79cAffected
15f02b91056253e8cdc592888f431da0731337b8 to before 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1Affected
15f02b91056253e8cdc592888f431da0731337b8 to before f39049304ba655ffcbb92edbdf8c51a1f1210bedAffected
15f02b91056253e8cdc592888f431da0731337b8 to before 8e7977afaef37c6bd2b2654f1bce6ab40d471147Affected
15f02b91056253e8cdc592888f431da0731337b8 to before 00e1950716c6ed67d74777b2db286b0fa23b4be9Affected

LinuxLinux

5.7Affected
before 5.7Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.