PT-2026-61293 · Linux · Linux

CVE-2026-63976 · Publicado 2026-07-19 · Atualizado 2026-07-19

Mitre

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

l2cap ecred reconf rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap ecred conn rsp, l2cap le connect rsp, l2cap config rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value.

A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap chan del(chan, ECONNRESET).

Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap chan hold unless zero() consistent with other L2CAP handlers (l2cap le command rej, l2cap get chan by ident).

Correção

Identificadores relacionados

CVE-2026-63976

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526 · Nota
• https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed · Nota
• https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a · Nota
• https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63976 · Nota de Segurança
• https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78 · Nota
• https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9 · Nota
• https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147 · Nota
• https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c · Nota