Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow a nearby attacker to obtain sensitive internal memory information. By interacting with a device over Bluetooth, an attacker can receive data that includes internal kernel memory addresses. This leak could potentially be used to bypass security protections like KASLR, though it does not directly allow for full system takeover or data theft.
Technical details
A regression in the L2CAP subsystem was introduced when converting on-stack request PDUs to use DEFINE_RAW_FLEX to avoid compiler warnings. In l2cap_ecred_reconfigure, the code incorrectly passed the address of a local pointer (&pdu) and the size of the pointer itself to l2cap_send_cmd, rather than the address and size of the actual PDU structure. This results in the L2CAP_ECRED_RECONF_REQ packet containing 4-8 bytes of kernel stack memory (specifically the value of the pdu pointer) instead of the intended configuration data. An attacker within Bluetooth range can capture these packets to leak kernel virtual addresses, potentially aiding in KASLR bypass. The issue has been patched by correctly passing the struct address and using struct_size() for the length.
Affected products
- Linux Linux Kernel 7.0
Timeline
- 2026-05-11: other: Patch authored
- 2026-07-19: disclosed: CVE published