PT-2026-61293 · Linux · Linux

CVE-2026-63976 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

l2cap ecred reconf rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap ecred conn rsp, l2cap le connect rsp, l2cap config rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value.

A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap chan del(chan, ECONNRESET).

Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap chan hold unless zero() consistent with other L2CAP handlers (l2cap le command rej, l2cap get chan by ident).

Fix

Related Identifiers

CVE-2026-63976

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-63976 · Security Note
• https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526 · Note
• https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed · Note
• https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a · Note
• https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1 · Note
• https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78 · Note
• https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9 · Note
• https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147 · Note
• https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c · Note