CVE-2026-63976: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
l2capecredreconfrsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2capecredconnrsp, l2capleconnectrsp, l2capconfigrsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value.
A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2capchandel(chan, ECONNRESET).
Clear chan->ident for all matching channels on success, and harden the failure path by using l2capchanholdunlesszero() consistent with other L2CAP handlers (l2caplecommandrej, l2capgetchanbyident).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63976?
CVE-2026-63976 has a risk rating of 45, indicating a moderate level of severity.
How do I fix CVE-2026-63976?
To fix CVE-2026-63976, update to the latest version of the Linux kernel where the vulnerability has been resolved.
What systems are affected by CVE-2026-63976?
CVE-2026-63976 affects the Bluetooth functionality in the Linux kernel.
What does CVE-2026-63976 involve?
CVE-2026-63976 involves a failure to clear the chan->ident on ECRED reconfiguration success within the L2CAP layer of Bluetooth.
Is CVE-2026-63976 exploitable?
The exploitability of CVE-2026-63976 depends on the context of Bluetooth implementations and usage.