CVE-2026-63976
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value. A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET). Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).
How to fix
- Linux Linux59f5ecf6ad5c4db6ae81965a96156954a3b0d89a, ae0152d77d101c920769934fb102b18de0c6f526, c2afd2613fda90107c5e2fe8e855627451749c78, cc2b4f749de09975bfa06e58bbbad2f6acd4c79c, 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1, f39049304ba655ffcbb92edbdf8c51a1f1210bed, 8e7977afaef37c6bd2b2654f1bce6ab40d471147, 00e1950716c6ed67d74777b2db286b0fa23b4be9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < 59f5ecf6ad5c4db6ae81965a96156954a3b0d89a, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < ae0152d77d101c920769934fb102b18de0c6f526, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < c2afd2613fda90107c5e2fe8e855627451749c78, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < cc2b4f749de09975bfa06e58bbbad2f6acd4c79c, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < f39049304ba655ffcbb92edbdf8c51a1f1210bed, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < 8e7977afaef37c6bd2b2654f1bce6ab40d471147, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < 00e1950716c6ed67d74777b2db286b0fa23b4be9, 5.7 | 59f5ecf6ad5c4db6ae81965a96156954a3b0d89a, ae0152d77d101c920769934fb102b18de0c6f526, c2afd2613fda90107c5e2fe8e855627451749c78, cc2b4f749de09975bfa06e58bbbad2f6acd4c79c, 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1, f39049304ba655ffcbb92edbdf8c51a1f1210bed, 8e7977afaef37c6bd2b2654f1bce6ab40d471147, 00e1950716c6ed67d74777b2db286b0fa23b4be9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.