In the Linux kernel’s Bluetooth L2CAP stack, a new connection may inherit an incorrect channel mode, causing the creation of channels that incorrectly use EXT_FLOWCTL mode. When the kernel later processes a deferred E‑CRED response, this misuse triggers a stack out‑of‑bounds write in l2cap_ecred_rsp_defer(). The resulting memory corruption can crash the kernel or provide a foothold for further exploitation.

All Linux kernel installations that have the Bluetooth L2CAP modules enabled and that have not applied the fix are vulnerable. The flaw resides in core kernel code, so any distribution version of Linux kernel built before the commits referenced in the advisory is at risk whenever Bluetooth support is active.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of less than 1% (approximately 0.226%) suggests a low exploitation probability, though not zero. The flaw is not listed in CISA’s KEV catalog. Based on the description, an attacker would need to send crafted L2CAP packets—specifically an LE_CONN_REQ that triggers a deferred E‑CRED response—to a target with an enabled Bluetooth Low Energy interface. This could be a remote attack if the interface is publicly reachable or a local one if the attacker can interact directly with the device’s Bluetooth stack. Exploitation could lead to a kernel crash or, if the attacker can gain code execution, a privilege escalation.