CVE-2026-63975

Analyzed Analyzed - Analysis Complete

Bluetooth: L2CAP Channel Crash Fix in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-10-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan->dcid may be assigned previously it really needs to be disconnected. Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-02

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-08

NVD

CVE-2026-63975

EUVD

EUVD-2026-45748

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 5.7 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) issue where a crash can occur when handling an already-assigned destination CID (Channel Identifier). The problem arises when the system attempts to delete a channel improperly, potentially invalidating a cursor used in a safe iteration process. The fix involves scheduling an asynchronous channel closure instead of directly deleting the channel.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth L2CAP implementation and may not have direct detection commands. Monitor kernel logs for Bluetooth-related crashes or errors using dmesg or journalctl. Check for unexpected Bluetooth disconnections or channel issues.

Impact Analysis

This vulnerability could lead to system crashes or instability when Bluetooth connections are established or modified, potentially disrupting Bluetooth-dependent services or applications. Users might experience unexpected disconnections or system freezes during Bluetooth operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Bluetooth stack issue in the Linux kernel. Compliance impacts would depend on system-specific implementations and whether the vulnerability leads to unauthorized data access or processing, which is not described here.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this Bluetooth L2CAP vulnerability. Check your distribution's security advisories for kernel updates addressing CVE-2026-63975.

Hi! I’m here to help you understand CVE-2026-63975. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70