CVE-2026-63975
Received Received - Intake

Bluetooth: L2CAP Channel Crash Fix in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan->dcid may be assigned previously it really needs to be disconnected. Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63975
EUVD
EUVD-2026-45748

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) issue where a crash can occur when handling an already-assigned destination CID (Channel Identifier). The problem arises when the system attempts to delete a channel improperly, potentially invalidating a cursor used in a safe iteration process. The fix involves scheduling an asynchronous channel closure instead of directly deleting the channel.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth L2CAP implementation and may not have direct detection commands. Monitor kernel logs for Bluetooth-related crashes or errors using dmesg or journalctl. Check for unexpected Bluetooth disconnections or channel issues.

Impact Analysis

This vulnerability could lead to system crashes or instability when Bluetooth connections are established or modified, potentially disrupting Bluetooth-dependent services or applications. Users might experience unexpected disconnections or system freezes during Bluetooth operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Bluetooth stack issue in the Linux kernel. Compliance impacts would depend on system-specific implementations and whether the vulnerability leads to unauthorized data access or processing, which is not described here.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this Bluetooth L2CAP vulnerability. Check your distribution's security advisories for kernel updates addressing CVE-2026-63975.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63975. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart