CVE-2026-63976
Received Received - Intake

Bluetooth Channel Use-After-Free in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value. A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET). Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63976
EUVD
EUVD-2026-45749

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Bluetooth vulnerability in the Linux kernel where a remote attacker can exploit a flaw in the L2CAP protocol's reconfiguration process. When a peer successfully reconfigures a channel, the kernel fails to clear a specific identifier (chan->ident), allowing an attacker to replay a failure response with the old identifier. This causes the kernel to mistakenly destroy an already-established channel, leading to a denial of service.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth L2CAP implementation and requires kernel-level inspection. Detection involves checking kernel logs for Bluetooth-related errors or monitoring for unexpected channel deletions. Commands like dmesg | grep -i bluetooth or journalctl -k | grep -i l2cap may help identify issues. However, no direct detection commands are provided in the context.

Impact Analysis

If you use a system running a vulnerable Linux kernel version, an attacker within Bluetooth range could disrupt Bluetooth connections by forcing channels to reset. This may cause unexpected disconnections of Bluetooth devices like headphones, keyboards, or file transfers, leading to service interruptions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level Bluetooth implementation flaw in the Linux kernel. Compliance impacts would depend on whether the vulnerability could lead to unauthorized data access or disruption of services, but no evidence in the provided context suggests such effects.

Mitigation Strategies

Update the Linux kernel to the latest stable version where this vulnerability is patched. Monitor vendor advisories for kernel updates and apply them promptly. Disable Bluetooth if not in use as a temporary mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63976. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart