The Linux kernel's Bluetooth L2CAP implementation incorrectly accepts multiple connection requests with the same identifier. Because the code does not check for pending requests, it can mark more than the maximum allowed number of links (L2CAP_ECRED_MAX_CID=5) as pending. This causes an overflow in the allocated link list. The overflow can corrupt memory and leads to a denial of service by crashing the Bluetooth subsystem.

The flaw affects all Linux kernel versions that contain the vulnerable L2CAP code. All distributions that ship an unpatched kernel are affected. Patch is required regardless of distribution version but is only available in the latest kernel releases after the fix. The advisory refers to the kernel source and kernel.org commits for airborne patching.

The vulnerability scores an 8.8 on CVSS, indicating high severity. The EPSS score is below 1%, indicating a low probability of widespread exploitation. The flaw is not yet in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to connect to the vulnerable device over Bluetooth with a crafted L2CAP connection request; therefore the vector is inferred to be local or near-range Bluetooth, not internet‑accessible. Without the patch, an attacker could trigger the overflow whenever they send more than five overlapping L2CAP connection requests.