CVE-2026-63976 (GCVE-0-2026-63976)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-08-05 12:37
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value. A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET). Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).
References
Impacted products
Vendor Product Version
Linux Linux Version: 15f02b91056253e8cdc592888f431da0731337b8
Version: 15f02b91056253e8cdc592888f431da0731337b8
Version: 15f02b91056253e8cdc592888f431da0731337b8
Version: 15f02b91056253e8cdc592888f431da0731337b8
Version: 15f02b91056253e8cdc592888f431da0731337b8
Version: 15f02b91056253e8cdc592888f431da0731337b8
Version: 15f02b91056253e8cdc592888f431da0731337b8
Version: 15f02b91056253e8cdc592888f431da0731337b8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "59f5ecf6ad5c4db6ae81965a96156954a3b0d89a",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "ae0152d77d101c920769934fb102b18de0c6f526",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "c2afd2613fda90107c5e2fe8e855627451749c78",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "cc2b4f749de09975bfa06e58bbbad2f6acd4c79c",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "3b5b5f423b4fd23404a393bda8adba3cd6f74ef1",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "f39049304ba655ffcbb92edbdf8c51a1f1210bed",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "8e7977afaef37c6bd2b2654f1bce6ab40d471147",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "00e1950716c6ed67d74777b2db286b0fa23b4be9",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success\n\nl2cap_ecred_reconf_rsp() returns early on success without clearing\nchan-\u003eident. Every other L2CAP response handler (l2cap_ecred_conn_rsp,\nl2cap_le_connect_rsp, l2cap_config_rsp) clears chan-\u003eident after a\nsuccessful transaction to prevent the channel from matching subsequent\nresponses with the recycled ident value.\n\nA remote attacker that completed a reconfiguration as the peer can\nreplay a failure response with the stale ident, causing the kernel to\nmatch and destroy the already-established channel via\nl2cap_chan_del(chan, ECONNRESET).\n\nClear chan-\u003eident for all matching channels on success, and harden the\nfailure path by using l2cap_chan_hold_unless_zero() consistent with\nother L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is reached by sending crafted L2CAP ECRED reconfiguration responses over an established Bluetooth Low Energy ACL connection (HCI ACL \u2192 L2CAP LE signaling channel), which requires proximity on the same Bluetooth radio segment.\nAC:L - Once a BLE ECRED session exists, the remote peer fully controls signaling traffic and can reliably complete a reconfiguration handshake and then replay a failure response with the stale identifier; no special victim state or memory layout is required beyond an active connection.\nPR:N - Exploitation requires only the ability to act as a remote Bluetooth peer sending L2CAP signaling packets; no local shell access, capabilities, or root privileges on the victim host are needed.\nUI:N - No victim user action beyond having Bluetooth enabled and an attacker-established BLE connection is required; the attacker can inject the malicious L2CAP_ECRED_RECONF_RSP frames programmatically without user interaction.\nS:U - The impact is confined to the kernel Bluetooth/L2CAP security authority on the victim host and does not cross a VM, sandbox, or IOMMU boundary.\nC:H - The uncleorrected failure path used unsafe refcounting on matched channels, and stale-identifier matching during concurrent teardown can produce use-after-free conditions that are exploitable for kernel memory disclosure. The uncorrected failure path used unsafe refcounting on matched channels, and stale-identifier matching during concurrent teardown can produce use-after-free conditions that are exploitable for kernel memory disclosure.\nI:H - Erroneous `l2cap_chan_del()` on live channels corrupts kernel connection state, and the associated refcount/UAF race on the failure path can be leveraged for heap manipulation and potential arbitrary kernel write or code execution.\nA:H - A remote attacker can repeatedly force teardown of established ECRED L2CAP channels (denying Bluetooth services on phones, automotive, IoT, and embedded systems), and the underlying refcount bug can also trigger kernel crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:47.072Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147"
        },
        {
          "url": "https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9"
        }
      ],
      "title": "Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63976",
    "datePublished": "2026-07-19T14:56:01.284Z",
    "dateReserved": "2026-07-19T07:54:57.024Z",
    "dateUpdated": "2026-08-05T12:37:47.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.