CVE-2026-43062
Awaiting Analysis Awaiting Analysis - Queue
Bluetooth Type Confusion in Linux Kernel L2CAP

Publication date: 2026-05-05

Last updated on: 2026-05-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() l2cap_ecred_reconf_rsp() casts the incoming data to struct l2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes with result at offset 0). This causes two problems: - The sizeof(*rsp) length check requires 8 bytes instead of the correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected with -EPROTO. - rsp->result reads from offset 6 instead of offset 0, returning wrong data when the packet is large enough to pass the check. Fix by using the correct type. Also pass the already byte-swapped result variable to BT_DBG instead of the raw __le16 field.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-05
Last Modified
2026-05-05
Generated
2026-05-07
AI Q&A
2026-05-05
EPSS Evaluated
N/A
NVD
CVE-2026-43062
EUVD
EUVD-2026-27358
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux kernel *
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's Bluetooth L2CAP implementation, specifically in the function l2cap_ecred_reconf_rsp(). The function incorrectly casts incoming data to the wrong structure type, treating it as l2cap_ecred_conn_rsp (8 bytes) instead of the correct l2cap_ecred_reconf_rsp (2 bytes).

Because of this incorrect casting, two issues arise: first, the length check expects 8 bytes instead of 2, causing valid packets to be rejected; second, the code reads the result field from the wrong offset, returning incorrect data when the packet is large enough.

The fix involves using the correct structure type and properly handling the result variable.


How can this vulnerability impact me? :

This vulnerability can cause valid Bluetooth L2CAP ECRED reconnection response packets to be rejected incorrectly, potentially disrupting Bluetooth communication.

Additionally, because the result field is read from the wrong offset, the system may process incorrect data, which could lead to unexpected behavior or errors in Bluetooth connection handling.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart