CVE-2026-63975

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A crash can occur in the Bluetooth L2CAP layer during the processing of l2cap ecred conn rsp. When a destination CID (dcid) is received for a CID that has already been assigned, the specification requires both channels to be discarded. However, calling the l2cap chan del() function can invalidate the temporary cursor used by list for each entry safe. Additionally, since chan->dcid might have been previously assigned, the channel needs to be disconnected rather than simply deleted. To resolve this, the system should schedule l2cap chan timeout() with a delay of 0 to close the channel asynchronously.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.