CVE-2026-23395

Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ

Published Mar 25, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ

Currently the code attempts to accept requests regardless of the
command identifier which may cause multiple requests to be marked
as pending (FLAG_DEFER_SETUP) which can cause more than
L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer
causing an overflow.

The spec is quite clear that the same identifier shall not be used on
subsequent requests:

'Within each signaling channel a different Identifier shall be used
for each successive request or indication.'
https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d

So this attempts to check if there are any channels pending with the
same identifier and rejects if any are found.

Analysis

Technical impact

The Linux kernel's Bluetooth L2CAP implementation incorrectly accepts multiple connection requests with the same identifier. Because the code does not check for pending requests, it can mark more than the maximum allowed number of links (L2CAP_ECRED_MAX_CID=5) as pending. This causes an overflow in the allocated link list, which can corrupt memory and results in a denial of service by crashing the Bluetooth subsystem.

Affected Systems

The flaw affects all Linux kernel versions that contain the vulnerable L2CAP code. All distributions that ship an unpatched kernel are impacted. The patch is rolled into the latest kernel releases and is required regardless of distribution version. The advisory points to kernel source and kernel.org commits for guidance on applying the fix.

Risk and Exploitability

The vulnerability scores an 8.8 on CVSS, indicating high severity. The EPSS score is below 1%, indicating a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Attackers would need to connect to the device over Bluetooth with a crafted L2CAP connection request; thus the vector is inferred to be local or near‑range Bluetooth rather than internet‑accessible. Without the patch, an attacker could trigger the overflow by sending more than five overlapping L2CAP connection requests.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 10a7a702542240d5edb2b39450ac951c59ccd009
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 46e5b71666fb7652082e4e214a3365f4b14f1dc3
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< fb4a3a26483f3ea2cd21c7a2f7c45d5670600465
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 2124d82fd25e1671bb3ceb37998af5aae5903e06
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 6b949a6b33cbdf621d9fc6f0c48ac00915dbf514
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 8d0d94f8ba5b3a0beec3b0da558b9bea48018117
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< e72ee455297b794b852e5cea8d2d7bb17312172a
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 5b3e2052334f2ff6d5200e952f4aa66994d09899

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.20`	unaffected	≤ 6.18.*
`6.19.10`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:5.7:-::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[15f02b91056253e8cdc592888f431da0731337b8,fb4a3a26483f3ea2cd21c7a2f7c45d5670600465)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,2124d82fd25e1671bb3ceb37998af5aae5903e06)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,6b949a6b33cbdf621d9fc6f0c48ac00915dbf514)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,8d0d94f8ba5b3a0beec3b0da558b9bea48018117)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,e72ee455297b794b852e5cea8d2d7bb17312172a)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,5b3e2052334f2ff6d5200e952f4aa66994d09899)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.20,6.19.0)`	unaffected	semver	—
`[6.19.10,6.20.0)`	unaffected	semver	—
`[7.0-rc5,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a Linux kernel update that incorporates the L2CAP_ECRED_CONN_REQ patch.
If an immediate kernel upgrade is not feasible, disable Bluetooth on the affected device to eliminate the attack surface.
As a temporary countermeasure, limit Bluetooth discoverability and unpair any unnecessary neighboring devices to reduce exposure.

Generated by OpenCVE AI on October 19, 2026 at 20:59 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DLA	DLA-4606-1	linux security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.259% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-784472.html
https://git.kernel.org/stable/c/10a7a702542240d5edb2b39450ac951c59ccd009
https://git.kernel.org/stable/c/2124d82fd25e1671bb3ceb37998af5aae5903e06
https://git.kernel.org/stable/c/46e5b71666fb7652082e4e214a3365f4b14f1dc3
https://git.kernel.org/stable/c/5b3e2052334f2ff6d5200e952f4aa66994d09899
https://git.kernel.org/stable/c/6b949a6b33cbdf621d9fc6f0c48ac00915dbf514
https://git.kernel.org/stable/c/8d0d94f8ba5b3a0beec3b0da558b9bea48018117
https://git.kernel.org/stable/c/e72ee455297b794b852e5cea8d2d7bb17312172a
https://git.kernel.org/stable/c/fb4a3a26483f3ea2cd21c7a2f7c45d5670600465
https://lore.kernel.org/linux-cve-announce/2026032549-CVE-2026-23395-5e50@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23395
https://www.cve.org/CVERecord?id=CVE-2026-23395

History

Oct 19, 2026 7:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-20

Oct 16, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 15, 2026 2:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Apr 24, 2026 3:30 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:5.7:-:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

Apr 18, 2026 9:15 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/10a7a702542240d5edb2b39450ac951c59ccd009 https://git.kernel.org/stable/c/46e5b71666fb7652082e4e214a3365f4b14f1dc3

Apr 2, 2026 9:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Mar 26, 2026 12:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-122

Mar 26, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-1288
References		https://lore.kernel.org/linux-cve-announce/2026032549-CVE-2026-23395-5e50@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23395 https://www.cve.org/CVERecord?id=CVE-2026-23395
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Mar 25, 2026 10:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-122

Mar 25, 2026 10:45 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Currently the code attempts to accept requests regardless of the command identifier which may cause multiple requests to be marked as pending (FLAG_DEFER_SETUP) which can cause more than L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer causing an overflow. The spec is quite clear that the same identifier shall not be used on subsequent requests: 'Within each signaling channel a different Identifier shall be used for each successive request or indication.' https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d So this attempts to check if there are any channels pending with the same identifier and rejects if any are found.
Title		Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2124d82fd25e1671bb3ceb37998af5aae5903e06 https://git.kernel.org/stable/c/5b3e2052334f2ff6d5200e952f4aa66994d09899 https://git.kernel.org/stable/c/6b949a6b33cbdf621d9fc6f0c48ac00915dbf514 https://git.kernel.org/stable/c/8d0d94f8ba5b3a0beec3b0da558b9bea48018117 https://git.kernel.org/stable/c/e72ee455297b794b852e5cea8d2d7bb17312172a https://git.kernel.org/stable/c/fb4a3a26483f3ea2cd21c7a2f7c45d5670600465