Executive brief
A vulnerability in the Linux kernel's Bluetooth component could allow a nearby attacker to disrupt active Bluetooth connections. By replaying specific network responses during a connection update, an attacker can trick the system into prematurely closing established communication channels. This results in a denial-of-service for Bluetooth-connected devices but does not allow the attacker to steal data.
Technical details
A vulnerability exists in the L2CAP layer of the Linux kernel Bluetooth stack due to the `l2cap_ecred_reconf_rsp()` function failing to clear `chan->ident` upon successful Enhanced Credit Based Mode (ECRED) reconfiguration. Because the identifier is not reset, it remains valid for matching subsequent responses. A remote attacker who has already established a peer relationship can replay a failure response using the stale identifier. This causes the kernel to incorrectly match the response to an active channel and invoke `l2cap_chan_del()`, resulting in an unexpected connection reset (ECONNRESET). The fix ensures `chan->ident` is cleared on success and hardens the failure path using `l2cap_chan_hold_unless_zero()`.
Affected products
- Linux Linux Kernel 5.10 to 6.9.x
Timeline
- 2026-05-26: other: Vulnerability fixed in upstream commits
- 2026-07-19: advisory: CVE published and NVD record created
References
- https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9
- https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1
- https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a
- https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147
- https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526
- https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78
- https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c