Executive brief
The Linux kernel's Bluetooth L2CAP layer has a resource leak in how it manages signaling identifiers (idents) for flow control commands. When a device sends repeated credit packets over a Bluetooth Low Energy connection, the ident pool becomes exhausted after ~254 packets, causing subsequent commands to be sent with an invalid identifier. This prevents the receiving device from processing flow control credits, effectively stalling the data connection after approximately 0.5 MB of received data.
Technical details
This vulnerability is a resource leak in the Linux Bluetooth L2CAP subsystem, specifically in the handling of LE Flow Control Credit (L2CAP_LE_CREDITS) commands. The root cause is that identifiers allocated for commands without a defined response (like L2CAP_LE_CREDITS) are never released back to the IDA pool, unlike commands that expect a response. As L2CAP_LE_CREDITS is sent repeatedly during an LE Connection-Oriented Channel (CoC) lifetime, the 1-255 ident range is exhausted after 254 credit packets. Once exhausted, l2cap_get_ident() fails and subsequent packets are sent with ident 0, which is invalid per Bluetooth Core Spec. Remote stacks validating the ident drop these invalid commands, causing the channel to stall permanently. The fix releases the ident immediately after sending L2CAP_LE_CREDITS and adds proper ident release handling for L2CAP_LE_CONN_RSP responses.
Affected products
- Linux Linux Kernel unspecified
Timeline
- 2026-08-15: disclosed