Junglewise Threat Intelligence

CVE-2026-43062: Linux Kernel Bluetooth L2CAP type confusion in l2cap_ecred_reconf_rsp

CVE-2026-43062 · Severity: high · CVSS 7.1 · Published 2026-05-05

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Bluetooth subsystem that affects how devices handle connection reconfiguration requests. This flaw could allow a nearby attacker to cause communication errors or potentially manipulate the state of Bluetooth connections. While it primarily impacts the reliability of Bluetooth services, it could also be used to disrupt operations on affected systems.

Technical details

A type confusion vulnerability exists in the Linux kernel Bluetooth L2CAP implementation within the `l2cap_ecred_reconf_rsp()` function. The function incorrectly casts incoming data to `struct l2cap_ecred_conn_rsp` (8 bytes) instead of the intended `struct l2cap_ecred_reconf_rsp` (2 bytes). This mismatch causes the kernel to perform an incorrect length check, leading to the rejection of valid reconfiguration packets with an -EPROTO error. Furthermore, when packets are large enough to pass the incorrect check, the kernel reads the 'result' field from the wrong memory offset (offset 6 instead of offset 0). An attacker within Bluetooth range can exploit this to cause a denial of service or manipulate connection states. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 5.7 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4

Timeline

  • 2026-03-10: other: Vulnerability fixed in source code by author
  • 2026-05-05: advisory: CVE published by kernel.org
  • 2026-05-29: other: NVD analysis completed

References

Related threats