CVE-2026-63976

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth L2CAP implementation where the l2cap ecred reconf rsp() function fails to clear the chan->ident variable upon a successful ECRED reconfiguration. This differs from other L2CAP response handlers that clear this identifier to prevent channels from matching subsequent responses using recycled values. A remote attacker acting as a peer can replay a failure response using the stale identifier, leading the kernel to incorrectly match and destroy the established channel through the l2cap chan del(chan, ECONNRESET) function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.