CVE-2026-64127 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer

Commit 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end
warnings") converted the on-stack request PDU in l2cap_ecred_reconfigure()
from an explicit packed struct to DEFINE_RAW_FLEX(), but did not adjust the
size and source-pointer arguments to l2cap_send_cmd():

- struct {
- struct l2cap_ecred_reconf_req req;
- __le16 scid;
- } pdu;
+ DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1);
...
l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,
sizeof(pdu), &pdu);

After the conversion, DEFINE_RAW_FLEX() expands to declare an anonymous
union pdu_u plus a local pointer "pdu" pointing at it. Therefore:

- sizeof(pdu) is now sizeof(struct l2cap_ecred_reconf_req *) = 8 on
64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]).
- &pdu is the address of the local pointer's stack storage, not the
address of the request payload.

l2cap_send_cmd() forwards (data, count) to l2cap_build_cmd(), which calls
skb_put_data(skb, data, count). The L2CAP_ECRED_RECONFIGURE_REQ packet
body therefore contains 8 bytes copied from the kernel stack starting at
&pdu -- the 8 bytes overlap the pdu pointer's value, leaking a kernel
stack address to the paired Bluetooth peer. The intended (mtu, mps, scid)
fields are not transmitted at all, so the peer rejects the request as
malformed and the L2CAP_ECRED_RECONFIGURE feature itself has been broken
for the local-side initiator since the introducing commit landed.

The sibling site l2cap_ecred_conn_req() in the same commit was converted
correctly (sizeof(*pdu) + len, pdu); only this site was missed.

Restore the original semantics: pass the full flex-struct size via
struct_size(pdu, scid, 1) and the pdu pointer (the struct address) as
the source.

Validated on a stock 7.0-based host kernel via the real call path:
setsockopt(SOL_BLUETOOTH, BT_RCVMTU, ...) on a BT_CONNECTED
L2CAP_MODE_EXT_FLOWCTL socket emits an L2CAP_ECRED_RECONFIGURE_REQ
whose body is 8 bytes (the on-stack pdu local's value) rather than
the expected 6. Three captures from fresh socket / fresh hciemu peer
on the same host -- low bytes vary per call, high 0xffff confirms a
kernel virtual address (KASLR-randomised stack slot, not a fixed
string):

RECONF_REQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff
RECONF_REQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff
RECONF_REQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff

After this patch the body is 6 bytes carrying the expected
little-endian (mtu, mps, scid).

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A bug in the Linux kernel’s Bluetooth L2CAP module causes the ecred_reconfigure routine to send the address of a stack‑allocated pointer instead of the intended payload. The result is that a kernel stack address is leaked to a paired Bluetooth peer when a set‑socket option is made on an L2CAP_MODE_EXT_FLOWCTL socket. The malformed request also breaks the ECRED reconfigure feature on the local side, classified as CWE‑805.

Affected Systems

All Linux kernel installations that include the L2CAP_ECRED_RECONFIGURE path are affected; the issue appears in kernels built from 7.0 onward. Any system exposing Bluetooth sockets that allow setsockopt on a BT_RCVMTU option can trigger the vulnerability.

Risk and Exploitability

The vulnerability has a CVSS score of 5.5 and an EPSS of less than 1 %, indicating a low probability of real‑world exploitation at this time. It is not listed in the CISA KEV catalog. Exploitation would require a paired Bluetooth device that can trigger the vulnerable set‑socket option, and the primary impact is the disclosure of a kernel stack address to the peer. The CVE description demonstrates that attackers receive an 8‑byte payload containing this address, but no further exploitation steps are described in the advisory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1c08108f3014881ad5f4c35a2abaf9c65475035d`	affected	< ed5fcd2a26f0c16fc289c8cd6b03328a0582a687
`1c08108f3014881ad5f4c35a2abaf9c65475035d`	affected	< 051922ab709c0a6917eae765c22481dfc68379e5
`1c08108f3014881ad5f4c35a2abaf9c65475035d`	affected	< 356c9d1a1cbacd2a1640fff3c050e1c3472e924f
`1c08108f3014881ad5f4c35a2abaf9c65475035d`	affected	< 3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d

Linux

affected

Version	Status	Constraints
`6.10`	affected	—
`0`	unaffected	< 6.10
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1c08108f3014881ad5f4c35a2abaf9c65475035d,ed5fcd2a26f0c16fc289c8cd6b03328a0582a687)`	affected	code_commit	—
`[1c08108f3014881ad5f4c35a2abaf9c65475035d,051922ab709c0a6917eae765c22481dfc68379e5)`	affected	code_commit	—
`[1c08108f3014881ad5f4c35a2abaf9c65475035d,356c9d1a1cbacd2a1640fff3c050e1c3472e924f)`	affected	code_commit	—
`[1c08108f3014881ad5f4c35a2abaf9c65475035d,3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.10`	affected	generic	—
`[0,6.10)`	unaffected	generic	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that restores the correct size and source pointer in l2cap_ecred_reconfigure() (commit 1c08108f3014 or later).
Upgrade to a Linux kernel version that includes the fix; kernels newer than 7.0 with the relevant commit are recommended.
As a temporary workaround, disable the ECRED reconfigure feature or block Bluetooth devices from using L2CAP_MODE_EXT_FLOWCTL sockets, and monitor for malformed ECRED requests.

Generated by OpenCVE AI on July 30, 2026 at 20:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00175.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/051922ab709c0a6917eae765c22481dfc68379e5
https://git.kernel.org/stable/c/3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d
https://git.kernel.org/stable/c/356c9d1a1cbacd2a1640fff3c050e1c3472e924f
https://git.kernel.org/stable/c/ed5fcd2a26f0c16fc289c8cd6b03328a0582a687
https://lore.kernel.org/linux-cve-announce/2026071926-CVE-2026-64127-fb1b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64127
https://www.cve.org/CVERecord?id=CVE-2026-64127

History

Mon, 20 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-805
References		https://lore.kernel.org/linux-cve-announce/2026071926-CVE-2026-64127-fb1b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64127 https://www.cve.org/CVERecord?id=CVE-2026-64127
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings") converted the on-stack request PDU in l2cap_ecred_reconfigure() from an explicit packed struct to DEFINE_RAW_FLEX(), but did not adjust the size and source-pointer arguments to l2cap_send_cmd(): - struct { - struct l2cap_ecred_reconf_req req; - __le16 scid; - } pdu; + DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1); ... l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ, sizeof(pdu), &pdu); After the conversion, DEFINE_RAW_FLEX() expands to declare an anonymous union pdu_u plus a local pointer "pdu" pointing at it. Therefore: - sizeof(pdu) is now sizeof(struct l2cap_ecred_reconf_req ) = 8 on 64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]). - &pdu is the address of the local pointer's stack storage, not the address of the request payload. l2cap_send_cmd() forwards (data, count) to l2cap_build_cmd(), which calls skb_put_data(skb, data, count). The L2CAP_ECRED_RECONFIGURE_REQ packet body therefore contains 8 bytes copied from the kernel stack starting at &pdu -- the 8 bytes overlap the pdu pointer's value, leaking a kernel stack address to the paired Bluetooth peer. The intended (mtu, mps, scid) fields are not transmitted at all, so the peer rejects the request as malformed and the L2CAP_ECRED_RECONFIGURE feature itself has been broken for the local-side initiator since the introducing commit landed. The sibling site l2cap_ecred_conn_req() in the same commit was converted correctly (sizeof(pdu) + len, pdu); only this site was missed. Restore the original semantics: pass the full flex-struct size via struct_size(pdu, scid, 1) and the pdu pointer (the struct address) as the source. Validated on a stock 7.0-based host kernel via the real call path: setsockopt(SOL_BLUETOOTH, BT_RCVMTU, ...) on a BT_CONNECTED L2CAP_MODE_EXT_FLOWCTL socket emits an L2CAP_ECRED_RECONFIGURE_REQ whose body is 8 bytes (the on-stack pdu local's value) rather than the expected 6. Three captures from fresh socket / fresh hciemu peer on the same host -- low bytes vary per call, high 0xffff confirms a kernel virtual address (KASLR-randomised stack slot, not a fixed string): RECONF_REQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff After this patch the body is 6 bytes carrying the expected little-endian (mtu, mps, scid).
Title		Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/051922ab709c0a6917eae765c22481dfc68379e5 https://git.kernel.org/stable/c/3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d https://git.kernel.org/stable/c/356c9d1a1cbacd2a1640fff3c050e1c3472e924f https://git.kernel.org/stable/c/ed5fcd2a26f0c16fc289c8cd6b03328a0582a687

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:40:23.960Z

Updated: 2026-07-19T15:40:23.960Z

Reserved: 2026-07-19T07:54:57.036Z

Link: CVE-2026-64127

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64127 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T20:30:04Z

Weaknesses

CWE-805
Buffer Access with Incorrect Length Value

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object