CVE-2026-63976 (GCVE-0-2026-63976)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-05 12:37
VLAI
Title
Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value. A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET). Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 59f5ecf6ad5c4db6ae81965a96156954a3b0d89a (git)
Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < ae0152d77d101c920769934fb102b18de0c6f526 (git)
Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < c2afd2613fda90107c5e2fe8e855627451749c78 (git)
Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < cc2b4f749de09975bfa06e58bbbad2f6acd4c79c (git)
Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1 (git)
Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < f39049304ba655ffcbb92edbdf8c51a1f1210bed (git)
Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 8e7977afaef37c6bd2b2654f1bce6ab40d471147 (git)
Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 00e1950716c6ed67d74777b2db286b0fa23b4be9 (git)
Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "59f5ecf6ad5c4db6ae81965a96156954a3b0d89a",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "ae0152d77d101c920769934fb102b18de0c6f526",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "c2afd2613fda90107c5e2fe8e855627451749c78",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "cc2b4f749de09975bfa06e58bbbad2f6acd4c79c",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "3b5b5f423b4fd23404a393bda8adba3cd6f74ef1",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "f39049304ba655ffcbb92edbdf8c51a1f1210bed",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "8e7977afaef37c6bd2b2654f1bce6ab40d471147",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "00e1950716c6ed67d74777b2db286b0fa23b4be9",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success\n\nl2cap_ecred_reconf_rsp() returns early on success without clearing\nchan-\u003eident. Every other L2CAP response handler (l2cap_ecred_conn_rsp,\nl2cap_le_connect_rsp, l2cap_config_rsp) clears chan-\u003eident after a\nsuccessful transaction to prevent the channel from matching subsequent\nresponses with the recycled ident value.\n\nA remote attacker that completed a reconfiguration as the peer can\nreplay a failure response with the stale ident, causing the kernel to\nmatch and destroy the already-established channel via\nl2cap_chan_del(chan, ECONNRESET).\n\nClear chan-\u003eident for all matching channels on success, and harden the\nfailure path by using l2cap_chan_hold_unless_zero() consistent with\nother L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is reached by sending crafted L2CAP ECRED reconfiguration responses over an established Bluetooth Low Energy ACL connection (HCI ACL \u2192 L2CAP LE signaling channel), which requires proximity on the same Bluetooth radio segment.\nAC:L - Once a BLE ECRED session exists, the remote peer fully controls signaling traffic and can reliably complete a reconfiguration handshake and then replay a failure response with the stale identifier; no special victim state or memory layout is required beyond an active connection.\nPR:N - Exploitation requires only the ability to act as a remote Bluetooth peer sending L2CAP signaling packets; no local shell access, capabilities, or root privileges on the victim host are needed.\nUI:N - No victim user action beyond having Bluetooth enabled and an attacker-established BLE connection is required; the attacker can inject the malicious L2CAP_ECRED_RECONF_RSP frames programmatically without user interaction.\nS:U - The impact is confined to the kernel Bluetooth/L2CAP security authority on the victim host and does not cross a VM, sandbox, or IOMMU boundary.\nC:H - The uncleorrected failure path used unsafe refcounting on matched channels, and stale-identifier matching during concurrent teardown can produce use-after-free conditions that are exploitable for kernel memory disclosure. The uncorrected failure path used unsafe refcounting on matched channels, and stale-identifier matching during concurrent teardown can produce use-after-free conditions that are exploitable for kernel memory disclosure.\nI:H - Erroneous `l2cap_chan_del()` on live channels corrupts kernel connection state, and the associated refcount/UAF race on the failure path can be leveraged for heap manipulation and potential arbitrary kernel write or code execution.\nA:H - A remote attacker can repeatedly force teardown of established ECRED L2CAP channels (denying Bluetooth services on phones, automotive, IoT, and embedded systems), and the underlying refcount bug can also trigger kernel crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:47.072Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147"
        },
        {
          "url": "https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9"
        }
      ],
      "title": "Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63976",
    "datePublished": "2026-07-19T14:56:01.284Z",
    "dateReserved": "2026-07-19T07:54:57.024Z",
    "dateUpdated": "2026-08-05T12:37:47.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63976",
      "date": "2026-08-11",
      "epss": "0.00443",
      "percentile": "0.36592"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63976\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:16.733\",\"lastModified\":\"2026-07-30T14:51:11.223\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success\\n\\nl2cap_ecred_reconf_rsp() returns early on success without clearing\\nchan-\u003eident. Every other L2CAP response handler (l2cap_ecred_conn_rsp,\\nl2cap_le_connect_rsp, l2cap_config_rsp) clears chan-\u003eident after a\\nsuccessful transaction to prevent the channel from matching subsequent\\nresponses with the recycled ident value.\\n\\nA remote attacker that completed a reconfiguration as the peer can\\nreplay a failure response with the stale ident, causing the kernel to\\nmatch and destroy the already-established channel via\\nl2cap_chan_del(chan, ECONNRESET).\\n\\nClear chan-\u003eident for all matching channels on success, and harden the\\nfailure path by using l2cap_chan_hold_unless_zero() consistent with\\nother L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/l2cap_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"15f02b91056253e8cdc592888f431da0731337b8\",\"lessThan\":\"59f5ecf6ad5c4db6ae81965a96156954a3b0d89a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"15f02b91056253e8cdc592888f431da0731337b8\",\"lessThan\":\"ae0152d77d101c920769934fb102b18de0c6f526\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"15f02b91056253e8cdc592888f431da0731337b8\",\"lessThan\":\"c2afd2613fda90107c5e2fe8e855627451749c78\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"15f02b91056253e8cdc592888f431da0731337b8\",\"lessThan\":\"cc2b4f749de09975bfa06e58bbbad2f6acd4c79c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"15f02b91056253e8cdc592888f431da0731337b8\",\"lessThan\":\"3b5b5f423b4fd23404a393bda8adba3cd6f74ef1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"15f02b91056253e8cdc592888f431da0731337b8\",\"lessThan\":\"f39049304ba655ffcbb92edbdf8c51a1f1210bed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"15f02b91056253e8cdc592888f431da0731337b8\",\"lessThan\":\"8e7977afaef37c6bd2b2654f1bce6ab40d471147\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"15f02b91056253e8cdc592888f431da0731337b8\",\"lessThan\":\"00e1950716c6ed67d74777b2db286b0fa23b4be9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/l2cap_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-22T07:06:14+00:00",
      "cve": "CVE-2026-63976",
      "id": "CVE-2026-63976",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63976.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-10T16:24:31Z",
      "cve": "CVE-2026-63976",
      "id": "CVE-2026-63976",
      "initial_release_date": "2026-07-21T13:02:21Z",
      "product_status:first_fixed": "98",
      "product_status:known_affected": "132",
      "product_status:known_not_affected": "166",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63976",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63976.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.