The Linux kernel's Bluetooth L2CAP implementation incorrectly accepts multiple connection requests with the same identifier. Because the code does not check for pending requests, it can mark more than the maximum allowed number of links (L2CAP_ECRED_MAX_CID=5) as pending. This causes an overflow in the allocated link list, which can corrupt memory and results in a denial of service by crashing the Bluetooth subsystem.

The flaw affects all Linux kernel versions that contain the vulnerable L2CAP code. All distributions that ship an unpatched kernel are impacted. The patch is rolled into the latest kernel releases and is required regardless of distribution version. The advisory points to kernel source and kernel.org commits for guidance on applying the fix.

The vulnerability scores an 8.8 on CVSS, indicating high severity. The EPSS score is below 1%, indicating a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Attackers would need to connect to the device over Bluetooth with a crafted L2CAP connection request; thus the vector is inferred to be local or near‑range Bluetooth rather than internet‑accessible. Without the patch, an attacker could trigger the overflow by sending more than five overlapping L2CAP connection requests.