CVE-2026-64127: Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: ecredreconfigure: send packed pdu, not stack pointer

Commit 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings") converted the on-stack request PDU in l2capecredreconfigure() from an explicit packed struct to DEFINERAWFLEX(), but did not adjust the size and source-pointer arguments to l2capsendcmd():

- struct { - struct l2capecredreconfreq req; - le16 scid; - } pdu; + DEFINERAWFLEX(struct l2capecredreconfreq, pdu, scid, 1); ... l2capsendcmd(conn, chan->ident, L2CAPECREDRECONFREQ, sizeof(pdu), &pdu);

After the conversion, DEFINERAWFLEX() expands to declare an anonymous union pduu plus a local pointer "pdu" pointing at it. Therefore:

- sizeof(pdu) is now sizeof(struct l2capecredreconfreq ) = 8 on 64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]). - &pdu is the address of the local pointer's stack storage, not the address of the request payload.

l2capsendcmd() forwards (data, count) to l2capbuildcmd(), which calls skbputdata(skb, data, count). The L2CAPECREDRECONFIGUREREQ packet body therefore contains 8 bytes copied from the kernel stack starting at &pdu -- the 8 bytes overlap the pdu pointer's value, leaking a kernel stack address to the paired Bluetooth peer. The intended (mtu, mps, scid) fields are not transmitted at all, so the peer rejects the request as malformed and the L2CAPECREDRECONFIGURE feature itself has been broken for the local-side initiator since the introducing commit landed.

The sibling site l2capecredconnreq() in the same commit was converted correctly (sizeof(pdu) + len, pdu); only this site was missed.

Restore the original semantics: pass the full flex-struct size via structsize(pdu, scid, 1) and the pdu pointer (the struct address) as the source.

Validated on a stock 7.0-based host kernel via the real call path: setsockopt(SOLBLUETOOTH, BTRCVMTU, ...) on a BTCONNECTED L2CAPMODEEXTFLOWCTL socket emits an L2CAPECREDRECONFIGUREREQ whose body is 8 bytes (the on-stack pdu local's value) rather than the expected 6. Three captures from fresh socket / fresh hciemu peer on the same host -- low bytes vary per call, high 0xffff confirms a kernel virtual address (KASLR-randomised stack slot, not a fixed string):

RECONFREQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff RECONFREQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff RECONFREQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff

After this patch the body is 6 bytes carrying the expected little-endian (mtu, mps, scid).