CVE-2026-72333

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth L2CAP layer where transmission identifiers (idents) are not released for commands that do not require a response. Specifically, the L2CAP LE CREDITS command is sent repeatedly during the lifetime of an LE CoC channel. Because these identifiers are not released, the available range (1-255) is exhausted after 254 credit packets. Once exhausted, the l2cap get ident() function fails, and subsequent packets are sent with an invalid identifier of 0. This causes remote stacks that validate identifiers to drop the commands, leading to a permanent channel stall. This typically occurs after approximately 0.5 MB of received data, depending on the socket receive buffer. Additionally, identifiers for outgoing L2CAP LE CONN REQ commands were not being released upon receiving a L2CAP LE CONN RSP response.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.