CVE-2026-63975
Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan->dcid may be assigned previously it really needs to be disconnected. Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/3c8eaa91eb433c450426539290be4ffe282e9f00
- https://git.kernel.org/stable/c/ecfed1e0d8efecad6737a0d83e21d2fd021d8c48
- https://git.kernel.org/stable/c/e6833e737a51db1e5ea0401322acf5e22abd8be6
- https://git.kernel.org/stable/c/6319b38fe69f56ed95680ade485b957a53fff642
- https://git.kernel.org/stable/c/291eec1041c918c460dc9702e44edd17794b4a4b
References (8)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.