CVE-2026-63975 - Vulnerability Details

- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

If dcid is received for an already-assigned destination CID the spec
requires that both channels to be discarded, but calling l2cap_chan_del
may invalidate the tmp cursor created by list_for_each_entry_safe and
in fact it is the wrong procedure as the chan->dcid may be assigned
previously it really needs to be disconnected.

Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so
instead schedule l2cap_chan_timeout with delay 0 to close the channel
asynchronously.

Published: 2026-07-19

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel’s Bluetooth L2CAP subsystem can trigger a kernel panic when an attacker sends a specially crafted packet that includes a destination channel identifier (dcid) that conflicts with an already assigned channel. The bug stems from an improper use of a list cursor during channel deletion or cloning, which can result in a use‑after‑free or memory corruption (CWE-416, CWE-667). The crash prevents system functionality, providing attackers only a denial‑of‑service without direct impact on confidentiality or integrity.

Affected Systems

All Linux kernels that ship the unpatched Bluetooth L2CAP code are affected. This includes every distribution that has not yet applied the upstream patch; it applies to the generic kernel and all release candidates under development until a vendor releases a secured kernel update.

Risk and Exploitability

The CVSS base score of 8.8 indicates a high‑risk vulnerability, while the EPSS score of < 1 % signals a very low probability of active exploitation at the time of this analysis. The bug is not listed in the CISA KEV catalog. The inferred attack vector is the delivery of a crafted Bluetooth L2CAP packet that provides a conflicting dcid, which does not require elevated privileges or special physical proximity beyond normal Bluetooth communication. The exploit would simply crash the kernel, potentially requiring a reboot to recover.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 3c8eaa91eb433c450426539290be4ffe282e9f00
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< ecfed1e0d8efecad6737a0d83e21d2fd021d8c48
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< e6833e737a51db1e5ea0401322acf5e22abd8be6
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 6319b38fe69f56ed95680ade485b957a53fff642
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 291eec1041c918c460dc9702e44edd17794b4a4b
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 41e29548b5e8b5e5fcf708786b3bea67cab107fa
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< d153b8898c0051eb8b6a083b35cbe304a5886bd5
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 41c2713b204e6cb6a94587bc6bf6935107df5479

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[15f02b91056253e8cdc592888f431da0731337b8,3c8eaa91eb433c450426539290be4ffe282e9f00)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,ecfed1e0d8efecad6737a0d83e21d2fd021d8c48)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,e6833e737a51db1e5ea0401322acf5e22abd8be6)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,6319b38fe69f56ed95680ade485b957a53fff642)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,291eec1041c918c460dc9702e44edd17794b4a4b)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,41e29548b5e8b5e5fcf708786b3bea67cab107fa)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,d153b8898c0051eb8b6a083b35cbe304a5886bd5)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,41c2713b204e6cb6a94587bc6bf6935107df5479)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.7,5.7]`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[5.10.259,5.10.*]`	unaffected	generic	—
`[5.15.210,5.15.*]`	unaffected	generic	—
`[6.1.176,6.1.*]`	unaffected	generic	—
`[6.6.143,6.6.*]`	unaffected	generic	—
`[6.12.93,6.12.*]`	unaffected	generic	—
`[6.18.35,6.18.*]`	unaffected	generic	—
`[7.0.12,7.0.*]`	unaffected	generic	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that includes the L2CAP crash mitigation.
Reboot the system after updating to load the patched kernel.
If an immediate update is not available, disable the Bluetooth daemon or block incoming L2CAP traffic with firewall rules to prevent the vulnerable packet from reaching the kernel.

Generated by OpenCVE AI on October 20, 2026 at 09:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8903-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8904-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8905-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8906-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8903-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8905-2	Linux kernel (GCP) vulnerabilities

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00274.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/291eec1041c918c460dc9702e44edd17794b4a4b
https://git.kernel.org/stable/c/3c8eaa91eb433c450426539290be4ffe282e9f00
https://git.kernel.org/stable/c/41c2713b204e6cb6a94587bc6bf6935107df5479
https://git.kernel.org/stable/c/41e29548b5e8b5e5fcf708786b3bea67cab107fa
https://git.kernel.org/stable/c/6319b38fe69f56ed95680ade485b957a53fff642
https://git.kernel.org/stable/c/d153b8898c0051eb8b6a083b35cbe304a5886bd5
https://git.kernel.org/stable/c/e6833e737a51db1e5ea0401322acf5e22abd8be6
https://git.kernel.org/stable/c/ecfed1e0d8efecad6737a0d83e21d2fd021d8c48
https://lore.kernel.org/linux-cve-announce/2026071900-CVE-2026-63975-635f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63975
https://www.cve.org/CVERecord?id=CVE-2026-63975

History

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-667

Fri, 02 Oct 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::

Wed, 22 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026071900-CVE-2026-63975-635f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63975 https://www.cve.org/CVERecord?id=CVE-2026-63975
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan->dcid may be assigned previously it really needs to be disconnected. Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously.
Title		Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/291eec1041c918c460dc9702e44edd17794b4a4b https://git.kernel.org/stable/c/3c8eaa91eb433c450426539290be4ffe282e9f00 https://git.kernel.org/stable/c/41c2713b204e6cb6a94587bc6bf6935107df5479 https://git.kernel.org/stable/c/41e29548b5e8b5e5fcf708786b3bea67cab107fa https://git.kernel.org/stable/c/6319b38fe69f56ed95680ade485b957a53fff642 https://git.kernel.org/stable/c/d153b8898c0051eb8b6a083b35cbe304a5886bd5 https://git.kernel.org/stable/c/e6833e737a51db1e5ea0401322acf5e22abd8be6 https://git.kernel.org/stable/c/ecfed1e0d8efecad6737a0d83e21d2fd021d8c48

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:56:00.662Z

Updated: 2026-10-19T20:17:59.722Z

Reserved: 2026-07-19T07:54:57.024Z

Link: CVE-2026-63975

Vulnrichment

No data.

NVD

Status : Modified

Published: 2026-07-19T16:17:16.603

Modified: 2026-10-19T21:17:15.070

Link: CVE-2026-63975

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63975 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T09:15:12Z

Weaknesses

CWE-416
Use After Free
CWE-667
Improper Locking
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object