CVE-2026-63976 - Vulnerability Details

- Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

l2cap_ecred_reconf_rsp() returns early on success without clearing
chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp,
l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a
successful transaction to prevent the channel from matching subsequent
responses with the recycled ident value.

A remote attacker that completed a reconfiguration as the peer can
replay a failure response with the stale ident, causing the kernel to
match and destroy the already-established channel via
l2cap_chan_del(chan, ECONNRESET).

Clear chan->ident for all matching channels on success, and harden the
failure path by using l2cap_chan_hold_unless_zero() consistent with
other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).

Published: 2026-07-19

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel’s Bluetooth L2CAP implementation allows an attacker who has successfully reconfigured a connection as the peer to replay a failure response with a stale identifier. Because the handler l2cap_ecred_reconf_rsp() fails to clear the channel’s identification field on success, the stale value can match a current channel, causing the kernel to delete that channel and reset the connection, effectively disrupting the Bluetooth session and denying service to legitimate users. The weakness is identified as CWE-1341.

Affected Systems

The issue exists in the Linux kernel’s Bluetooth stack when the l2cap_ecred_reconf_rsp handler is compiled into the kernel. No specific kernel versions are listed, so all builds containing this handler could be affected until the patch is applied.

Risk and Exploitability

The vulnerability scores a high CVSS score of 8.8, but the EPSS score of less than 1% indicates a low current likelihood of exploitation. It is not listed in CISA’s KEV catalog. A remote attacker would need to communicate over Bluetooth and successfully complete a reconfiguration with the peer before replaying the crafted failure response. If the attack succeeds, it results in an immediate destruction of the connection, causing a denial of service for the user.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 59f5ecf6ad5c4db6ae81965a96156954a3b0d89a
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< ae0152d77d101c920769934fb102b18de0c6f526
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< c2afd2613fda90107c5e2fe8e855627451749c78
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< cc2b4f749de09975bfa06e58bbbad2f6acd4c79c
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< f39049304ba655ffcbb92edbdf8c51a1f1210bed
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 8e7977afaef37c6bd2b2654f1bce6ab40d471147
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 00e1950716c6ed67d74777b2db286b0fa23b4be9

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[15f02b91056253e8cdc592888f431da0731337b8,59f5ecf6ad5c4db6ae81965a96156954a3b0d89a)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,ae0152d77d101c920769934fb102b18de0c6f526)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,c2afd2613fda90107c5e2fe8e855627451749c78)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,cc2b4f749de09975bfa06e58bbbad2f6acd4c79c)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,3b5b5f423b4fd23404a393bda8adba3cd6f74ef1)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,f39049304ba655ffcbb92edbdf8c51a1f1210bed)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,8e7977afaef37c6bd2b2654f1bce6ab40d471147)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,00e1950716c6ed67d74777b2db286b0fa23b4be9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the fix for l2cap_ecred_reconf_rsp, which clears chan->ident on success and hardens the failure path.
If a kernel update is not immediately available, consider disabling the Bluetooth L2CAP service or restricting Bluetooth access on the affected hosts to prevent the attack surface from being exposed.
Ensure that the kernel configuration does not retain legacy or optional Bluetooth modules that may still reference the vulnerable handler until the patch is applied.

Generated by OpenCVE AI on August 4, 2026 at 06:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00443.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9
https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1
https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a
https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147
https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526
https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78
https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c
https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed
https://lore.kernel.org/linux-cve-announce/2026071901-CVE-2026-63976-f786@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63976
https://www.cve.org/CVERecord?id=CVE-2026-63976

History

Sun, 26 Jul 2026 08:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-635 CWE-665

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://lore.kernel.org/linux-cve-announce/2026071901-CVE-2026-63976-f786@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63976 https://www.cve.org/CVERecord?id=CVE-2026-63976
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 21 Jul 2026 23:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-635 CWE-665

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value. A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET). Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).
Title		Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9 https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1 https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147 https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526 https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78 https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:56:01.284Z

Updated: 2026-08-05T12:37:47.072Z

Reserved: 2026-07-19T07:54:57.024Z

Link: CVE-2026-63976

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63976 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T06:30:05Z

Weaknesses

CWE-1341
Multiple Releases of Same Resource or Handle

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object