CVE-2026-72333 - Vulnerability Details

- Bluetooth: L2CAP: fix tx ident leak for commands without a response

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix tx ident leak for commands without a response

Commit 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding
TX ident") changed ident allocation to use an IDA, releasing idents in
l2cap_put_ident() when the matching response command is received.

But identifiers allocated for commands that have no response defined
are never released. In particular L2CAP_LE_CREDITS is sent repeatedly for
the lifetime of an LE CoC channel, so a peer streaming data to the
host exhausts the 1-255 ident range after 254 credit packets. From
then on l2cap_get_ident() fails:

kernel: Bluetooth: Unable to allocate ident: -28

and every subsequent L2CAP_LE_CREDITS packet is sent with ident 0,
which is invalid (Core Spec, Vol 3, Part A, Section 4: "Signaling
identifier 0x00 is an invalid identifier and shall never be used in
any command"). Remote stacks that validate the ident drop these
commands, never receive new credits, and the channel stalls
permanently. With default socket buffers this happens after roughly 0.5 MB
of received data (the exact amount depends on the socket receive buffer):

< ACL Data TX: Handle 2048 flags 0x00 dlen 12
LE L2CAP: LE Flow Control Credit (0x16) ident 0 len 4
Source CID: 64
Credits: 1

Release the ident immediately after sending L2CAP_LE_CREDITS since no
response will ever release it. Use a local variable instead of
chan->ident so that an ident that an EXT_FLOWCTL channel may be waiting on
(e.g. a pending reconfigure) is not overwritten by a credit packet.

Also add the missing L2CAP_LE_CONN_RSP case to l2cap_put_ident() so
idents allocated for outgoing L2CAP_LE_CONN_REQ commands are released
when the response arrives.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw lies in the Linux kernel’s Bluetooth L2CAP implementation where identifiers allocated for commands that never receive a response are never released. When an adapter repeatedly sends L2CAP_LE_CREDITS packets, the 1–255 identifier range is exhausted, causing the kernel to reuse identifier 0 for subsequent packets. According to the Core Specification, identifier 0 is prohibited, so the peer drops those messages and the L2CAP channel stalls. In practice a single stream can exhaust the identifiers after roughly half a megabyte of data, leading to a permanent service disruption.

Affected Systems

The issue affects all Linux kernel releases that lack the 6c3ea155e5ee commit. The affected component is the kernel Bluetooth L2CAP transport. Updating to any kernel version that incorporates this commit removes the leak.

Risk and Exploitability

Because the vulnerability can be triggered by any Bluetooth device that streams data over an LE CoC channel, an attacker can cause a denial of service remotely without elevated privileges. The CVSS score of 5.5 indicates a medium level of severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation. The attack path is straightforward: a peer repeatedly sends L2CAP_LE_CREDITS packets, exhausting the 1–255 identifier range so that subsequent packets are sent with the invalid identifier 0, causing the peer to drop them and the channel to stall. Although the impact is a permanent service disruption for the affected channel, the overall risk for typical environments is low to moderate, and the vulnerability is not presently listed in CISA’s KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e86554c37d3d2b4b24608e0313f882cae28b8adb`	affected	< b8a32a5fc915b024c60f18d51b6cffd2bd64d4a6
`9b24ad4787cad46a3917620799f8455c6533b8df`	affected	< bd1e01170341291292fd4c46b5f6949da282ca6c
`ea6cf86167b3972caa68972d2a1ad43ecbbb8331`	affected	< 0c602cb8f148a36bfb39c25ade400bdadc023c4f
`6c3ea155e5ee3e56606233acde8309afda66d483`	affected	< d0a2b0c81f112540a337cde1c20251bf05ddf1da
`6c3ea155e5ee3e56606233acde8309afda66d483`	affected	< 6e1930ece855a4c256f1c7e6632d634cfb9888b5
`ed97bb2cf96684ee646be6f37e4c4835f9d30caa`	affected	—
`84bc3197f7d87c5b89c156e853d0561a9154eceb`	affected	—
`8c1cdbc1bacc0cf9c27c3ebda11a81c3dcd01630`	affected	—
`6.18.21`	affected	< 6.18.40
`5.10.261`	affected	< 5.11
`5.15.212`	affected	< 5.16
`6.19.11`	affected	< 6.20

Linux

affected

Version	Status	Constraints
`7.0`	affected	—
`0`	unaffected	< 7.0
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e86554c37d3d2b4b24608e0313f882cae28b8adb,b8a32a5fc915b024c60f18d51b6cffd2bd64d4a6)`	affected	code_commit	—
`[9b24ad4787cad46a3917620799f8455c6533b8df,bd1e01170341291292fd4c46b5f6949da282ca6c)`	affected	code_commit	—
`[ea6cf86167b3972caa68972d2a1ad43ecbbb8331,0c602cb8f148a36bfb39c25ade400bdadc023c4f)`	affected	code_commit	—
`[6c3ea155e5ee3e56606233acde8309afda66d483,d0a2b0c81f112540a337cde1c20251bf05ddf1da)`	affected	code_commit	—
`[6c3ea155e5ee3e56606233acde8309afda66d483,6e1930ece855a4c256f1c7e6632d634cfb9888b5)`	affected	code_commit	—
`ed97bb2cf96684ee646be6f37e4c4835f9d30caa`	affected	code_commit	—
`84bc3197f7d87c5b89c156e853d0561a9154eceb`	affected	code_commit	—
`8c1cdbc1bacc0cf9c27c3ebda11a81c3dcd01630`	affected	code_commit	—
`[6.18.21,6.18.40)`	affected	semver	—
`[5.10.261,5.11)`	affected	semver	—
`[5.15.212,5.16)`	affected	semver	—
`[6.19.11,6.20)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`7.0`	affected	generic	—
`[0,7.0)`	unaffected	generic	—
`[6.18.40,6.18.*]`	unaffected	generic	—
`[7.1.5,7.1.*]`	unaffected	generic	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the 6c3ea155e5ee commit, which immediately releases identifiers once a credit packet is sent.
Reboot the system to load the updated kernel and ensure the Bluetooth stack uses the patched code.
Monitor kernel logs for the message "Unable to allocate ident: -28" or repeated use of ident 0, which would indicate the issue persists and warrant further investigation.

Generated by OpenCVE AI on August 22, 2026 at 08:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0c602cb8f148a36bfb39c25ade400bdadc023c4f
https://git.kernel.org/stable/c/6e1930ece855a4c256f1c7e6632d634cfb9888b5
https://git.kernel.org/stable/c/b8a32a5fc915b024c60f18d51b6cffd2bd64d4a6
https://git.kernel.org/stable/c/bd1e01170341291292fd4c46b5f6949da282ca6c
https://git.kernel.org/stable/c/d0a2b0c81f112540a337cde1c20251bf05ddf1da
https://lore.kernel.org/linux-cve-announce/2026081508-CVE-2026-72333-b41d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72333
https://www.cve.org/CVERecord?id=CVE-2026-72333

History

Sat, 22 Aug 2026 07:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-399

Wed, 19 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026081508-CVE-2026-72333-b41d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72333 https://www.cve.org/CVERecord?id=CVE-2026-72333
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 11:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-399

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident") changed ident allocation to use an IDA, releasing idents in l2cap_put_ident() when the matching response command is received. But identifiers allocated for commands that have no response defined are never released. In particular L2CAP_LE_CREDITS is sent repeatedly for the lifetime of an LE CoC channel, so a peer streaming data to the host exhausts the 1-255 ident range after 254 credit packets. From then on l2cap_get_ident() fails: kernel: Bluetooth: Unable to allocate ident: -28 and every subsequent L2CAP_LE_CREDITS packet is sent with ident 0, which is invalid (Core Spec, Vol 3, Part A, Section 4: "Signaling identifier 0x00 is an invalid identifier and shall never be used in any command"). Remote stacks that validate the ident drop these commands, never receive new credits, and the channel stalls permanently. With default socket buffers this happens after roughly 0.5 MB of received data (the exact amount depends on the socket receive buffer): < ACL Data TX: Handle 2048 flags 0x00 dlen 12 LE L2CAP: LE Flow Control Credit (0x16) ident 0 len 4 Source CID: 64 Credits: 1 Release the ident immediately after sending L2CAP_LE_CREDITS since no response will ever release it. Use a local variable instead of chan->ident so that an ident that an EXT_FLOWCTL channel may be waiting on (e.g. a pending reconfigure) is not overwritten by a credit packet. Also add the missing L2CAP_LE_CONN_RSP case to l2cap_put_ident() so idents allocated for outgoing L2CAP_LE_CONN_REQ commands are released when the response arrives.
Title		Bluetooth: L2CAP: fix tx ident leak for commands without a response
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0c602cb8f148a36bfb39c25ade400bdadc023c4f https://git.kernel.org/stable/c/6e1930ece855a4c256f1c7e6632d634cfb9888b5 https://git.kernel.org/stable/c/b8a32a5fc915b024c60f18d51b6cffd2bd64d4a6 https://git.kernel.org/stable/c/bd1e01170341291292fd4c46b5f6949da282ca6c https://git.kernel.org/stable/c/d0a2b0c81f112540a337cde1c20251bf05ddf1da

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:55:42.523Z

Updated: 2026-08-17T05:12:40.473Z

Reserved: 2026-08-09T03:40:39.920Z

Link: CVE-2026-72333

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:06.433

Modified: 2026-08-17T06:18:36.910

Link: CVE-2026-72333

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72333 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T08:45:03Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object