PT-2026-61444 · Linux · Linux

CVE-2026-64127

·

Publicado

2026-07-19

·

Atualizado

2026-07-19

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: ecred reconfigure: send packed pdu, not stack pointer
Commit 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings") converted the on-stack request PDU in l2cap ecred reconfigure() from an explicit packed struct to DEFINE RAW FLEX(), but did not adjust the size and source-pointer arguments to l2cap send cmd():
  • struct {
  •  struct l2cap ecred reconf req req;
  •   le16 scid;
  • } pdu;
  • DEFINE RAW FLEX(struct l2cap ecred reconf req, pdu, scid, 1); ... l2cap send cmd(conn, chan->ident, L2CAP ECRED RECONF REQ, sizeof(pdu), &pdu);
After the conversion, DEFINE RAW FLEX() expands to declare an anonymous union pdu u plus a local pointer "pdu" pointing at it. Therefore:
  • sizeof(pdu) is now sizeof(struct l2cap ecred reconf req *) = 8 on 64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]).
  • &pdu is the address of the local pointer's stack storage, not the address of the request payload.
l2cap send cmd() forwards (data, count) to l2cap build cmd(), which calls skb put data(skb, data, count). The L2CAP ECRED RECONFIGURE REQ packet body therefore contains 8 bytes copied from the kernel stack starting at &pdu -- the 8 bytes overlap the pdu pointer's value, leaking a kernel stack address to the paired Bluetooth peer. The intended (mtu, mps, scid) fields are not transmitted at all, so the peer rejects the request as malformed and the L2CAP ECRED RECONFIGURE feature itself has been broken for the local-side initiator since the introducing commit landed.
The sibling site l2cap ecred conn req() in the same commit was converted correctly (sizeof(*pdu) + len, pdu); only this site was missed.
Restore the original semantics: pass the full flex-struct size via struct size(pdu, scid, 1) and the pdu pointer (the struct address) as the source.
Validated on a stock 7.0-based host kernel via the real call path: setsockopt(SOL BLUETOOTH, BT RCVMTU, ...) on a BT CONNECTED L2CAP MODE EXT FLOWCTL socket emits an L2CAP ECRED RECONFIGURE REQ whose body is 8 bytes (the on-stack pdu local's value) rather than the expected 6. Three captures from fresh socket / fresh hciemu peer on the same host -- low bytes vary per call, high 0xffff confirms a kernel virtual address (KASLR-randomised stack slot, not a fixed string):
RECONF REQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff RECONF REQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff RECONF REQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff
After this patch the body is 6 bytes carrying the expected little-endian (mtu, mps, scid).
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64127

Produtos afetados

Linux