CVE-2026-63976

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63976", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.024Z", "datePublished": "2026-07-19T14:56:01.284Z", "dateUpdated": "2026-10-19T20:17:59.859Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:47.072Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: l2cap: clear chan->ident on ECRED reconfiguration success\n\nl2cap_ecred_reconf_rsp() returns early on success without clearing\nchan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp,\nl2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a\nsuccessful transaction to prevent the channel from matching subsequent\nresponses with the recycled ident value.\n\nA remote attacker that completed a reconfiguration as the peer can\nreplay a failure response with the stale ident, causing the kernel to\nmatch and destroy the already-established channel via\nl2cap_chan_del(chan, ECONNRESET).\n\nClear chan->ident for all matching channels on success, and harden the\nfailure path by using l2cap_chan_hold_unless_zero() consistent with\nother L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident)."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is reached by sending crafted L2CAP ECRED reconfiguration responses over an established Bluetooth Low Energy ACL connection (HCI ACL \u2192 L2CAP LE signaling channel), which requires proximity on the same Bluetooth radio segment.\nAC:L - Once a BLE ECRED session exists, the remote peer fully controls signaling traffic and can reliably complete a reconfiguration handshake and then replay a failure response with the stale identifier; no special victim state or memory layout is required beyond an active connection.\nPR:N - Exploitation requires only the ability to act as a remote Bluetooth peer sending L2CAP signaling packets; no local shell access, capabilities, or root privileges on the victim host are needed.\nUI:N - No victim user action beyond having Bluetooth enabled and an attacker-established BLE connection is required; the attacker can inject the malicious L2CAP_ECRED_RECONF_RSP frames programmatically without user interaction.\nS:U - The impact is confined to the kernel Bluetooth/L2CAP security authority on the victim host and does not cross a VM, sandbox, or IOMMU boundary.\nC:H - The uncleorrected failure path used unsafe refcounting on matched channels, and stale-identifier matching during concurrent teardown can produce use-after-free conditions that are exploitable for kernel memory disclosure. The uncorrected failure path used unsafe refcounting on matched channels, and stale-identifier matching during concurrent teardown can produce use-after-free conditions that are exploitable for kernel memory disclosure.\nI:H - Erroneous `l2cap_chan_del()` on live channels corrupts kernel connection state, and the associated refcount/UAF race on the failure path can be leveraged for heap manipulation and potential arbitrary kernel write or code execution.\nA:H - A remote attacker can repeatedly force teardown of established ECRED L2CAP channels (denying Bluetooth services on phones, automotive, IoT, and embedded systems), and the underlying refcount bug can also trigger kernel crashes."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/l2cap_core.c"], "versions": [{"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "59f5ecf6ad5c4db6ae81965a96156954a3b0d89a", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "ae0152d77d101c920769934fb102b18de0c6f526", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "c2afd2613fda90107c5e2fe8e855627451749c78", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "cc2b4f749de09975bfa06e58bbbad2f6acd4c79c", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "3b5b5f423b4fd23404a393bda8adba3cd6f74ef1", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "f39049304ba655ffcbb92edbdf8c51a1f1210bed", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "8e7977afaef37c6bd2b2654f1bce6ab40d471147", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "00e1950716c6ed67d74777b2db286b0fa23b4be9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/l2cap_core.c"], "versions": [{"version": "5.7", "status": "affected"}, {"version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a"}, {"url": "https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526"}, {"url": "https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78"}, {"url": "https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c"}, {"url": "https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1"}, {"url": "https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed"}, {"url": "https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147"}, {"url": "https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9"}], "title": "Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63976", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:34:26.280157Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-694", "description": "CWE-694 Use of Multiple Resources with Duplicate Identifier"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:17:59.859Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63976", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:34:26.280157Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-694", "description": "CWE-694 Use of Multiple Resources with Duplicate Identifier"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:34:26.858Z"}}], "cna": {"title": "Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is reached by sending crafted L2CAP ECRED reconfiguration responses over an established Bluetooth Low Energy ACL connection (HCI ACL \u2192 L2CAP LE signaling channel), which requires proximity on the same Bluetooth radio segment.\nAC:L - Once a BLE ECRED session exists, the remote peer fully controls signaling traffic and can reliably complete a reconfiguration handshake and then replay a failure response with the stale identifier; no special victim state or memory layout is required beyond an active connection.\nPR:N - Exploitation requires only the ability to act as a remote Bluetooth peer sending L2CAP signaling packets; no local shell access, capabilities, or root privileges on the victim host are needed.\nUI:N - No victim user action beyond having Bluetooth enabled and an attacker-established BLE connection is required; the attacker can inject the malicious L2CAP_ECRED_RECONF_RSP frames programmatically without user interaction.\nS:U - The impact is confined to the kernel Bluetooth/L2CAP security authority on the victim host and does not cross a VM, sandbox, or IOMMU boundary.\nC:H - The uncleorrected failure path used unsafe refcounting on matched channels, and stale-identifier matching during concurrent teardown can produce use-after-free conditions that are exploitable for kernel memory disclosure. The uncorrected failure path used unsafe refcounting on matched channels, and stale-identifier matching during concurrent teardown can produce use-after-free conditions that are exploitable for kernel memory disclosure.\nI:H - Erroneous `l2cap_chan_del()` on live channels corrupts kernel connection state, and the associated refcount/UAF race on the failure path can be leveraged for heap manipulation and potential arbitrary kernel write or code execution.\nA:H - A remote attacker can repeatedly force teardown of established ECRED L2CAP channels (denying Bluetooth services on phones, automotive, IoT, and embedded systems), and the underlying refcount bug can also trigger kernel crashes."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "59f5ecf6ad5c4db6ae81965a96156954a3b0d89a", "versionType": "git"}, {"status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "ae0152d77d101c920769934fb102b18de0c6f526", "versionType": "git"}, {"status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "c2afd2613fda90107c5e2fe8e855627451749c78", "versionType": "git"}, {"status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "cc2b4f749de09975bfa06e58bbbad2f6acd4c79c", "versionType": "git"}, {"status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "3b5b5f423b4fd23404a393bda8adba3cd6f74ef1", "versionType": "git"}, {"status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "f39049304ba655ffcbb92edbdf8c51a1f1210bed", "versionType": "git"}, {"status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "8e7977afaef37c6bd2b2654f1bce6ab40d471147", "versionType": "git"}, {"status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "00e1950716c6ed67d74777b2db286b0fa23b4be9", "versionType": "git"}], "programFiles": ["net/bluetooth/l2cap_core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"status": "unaffected", "version": "0", "lessThan": "5.7", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.259", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.93", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.35", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.12", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/l2cap_core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a"}, {"url": "https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526"}, {"url": "https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78"}, {"url": "https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c"}, {"url": "https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1"}, {"url": "https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed"}, {"url": "https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147"}, {"url": "https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: l2cap: clear chan->ident on ECRED reconfiguration success\n\nl2cap_ecred_reconf_rsp() returns early on success without clearing\nchan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp,\nl2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a\nsuccessful transaction to prevent the channel from matching subsequent\nresponses with the recycled ident value.\n\nA remote attacker that completed a reconfiguration as the peer can\nreplay a failure response with the stale ident, causing the kernel to\nmatch and destroy the already-established channel via\nl2cap_chan_del(chan, ECONNRESET).\n\nClear chan->ident for all matching channels on success, and harden the\nfailure path by using l2cap_chan_hold_unless_zero() consistent with\nother L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident)."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.259", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.143", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.93", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.35", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.12", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "5.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:47.072Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63976", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:17:59.859Z", "dateReserved": "2026-07-19T07:54:57.024Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:56:01.284Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/l2cap_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "59f5ecf6ad5c4db6ae81965a96156954a3b0d89a", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "ae0152d77d101c920769934fb102b18de0c6f526", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "c2afd2613fda90107c5e2fe8e855627451749c78", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "cc2b4f749de09975bfa06e58bbbad2f6acd4c79c", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "3b5b5f423b4fd23404a393bda8adba3cd6f74ef1", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "f39049304ba655ffcbb92edbdf8c51a1f1210bed", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "8e7977afaef37c6bd2b2654f1bce6ab40d471147", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "00e1950716c6ed67d74777b2db286b0fa23b4be9", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/l2cap_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8CC4A95D-0251-4FDF-8AFB-BBE0FAD54A79", "versionEndExcluding": "5.10.259", "versionStartIncluding": "5.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63", "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: l2cap: clear chan->ident on ECRED reconfiguration success\n\nl2cap_ecred_reconf_rsp() returns early on success without clearing\nchan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp,\nl2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a\nsuccessful transaction to prevent the channel from matching subsequent\nresponses with the recycled ident value.\n\nA remote attacker that completed a reconfiguration as the peer can\nreplay a failure response with the stale ident, causing the kernel to\nmatch and destroy the already-established channel via\nl2cap_chan_del(chan, ECONNRESET).\n\nClear chan->ident for all matching channels on success, and harden the\nfailure path by using l2cap_chan_hold_unless_zero() consistent with\nother L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident)."}], "id": "CVE-2026-63976", "lastModified": "2026-11-12T16:12:53.230", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63976", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:34:26.280157Z", "version": "2.0.3"}}]}, "published": "2026-07-19T16:17:16.733", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-694"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success", "id": "2502432", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502432"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: l2cap: clear chan->ident on ECRED reconfiguration success\nl2cap_ecred_reconf_rsp() returns early on success without clearing\nchan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp,\nl2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a\nsuccessful transaction to prevent the channel from matching subsequent\nresponses with the recycled ident value.\nA remote attacker that completed a reconfiguration as the peer can\nreplay a failure response with the stale ident, causing the kernel to\nmatch and destroy the already-established channel via\nl2cap_chan_del(chan, ECONNRESET).\nClear chan->ident for all matching channels on success, and harden the\nfailure path by using l2cap_chan_hold_unless_zero() consistent with\nother L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).", "A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation. A remote attacker, acting as a peer, could exploit a vulnerability where the system fails to clear a channel identifier after a successful Enhanced Credit Based Mode (ECRED) reconfiguration. By replaying a failure response with this stale identifier, the attacker can force the kernel to terminate an active Bluetooth connection, leading to a Denial of Service (DoS)."], "name": "CVE-2026-63976", "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63976\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63976\nhttps://lore.kernel.org/linux-cve-announce/2026071901-CVE-2026-63976-f786@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f02b91056253e8cdc592888f431da0731337b8,59f5ecf6ad5c4db6ae81965a96156954a3b0d89a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f02b91056253e8cdc592888f431da0731337b8,ae0152d77d101c920769934fb102b18de0c6f526)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f02b91056253e8cdc592888f431da0731337b8,c2afd2613fda90107c5e2fe8e855627451749c78)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f02b91056253e8cdc592888f431da0731337b8,cc2b4f749de09975bfa06e58bbbad2f6acd4c79c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f02b91056253e8cdc592888f431da0731337b8,3b5b5f423b4fd23404a393bda8adba3cd6f74ef1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f02b91056253e8cdc592888f431da0731337b8,f39049304ba655ffcbb92edbdf8c51a1f1210bed)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f02b91056253e8cdc592888f431da0731337b8,8e7977afaef37c6bd2b2654f1bce6ab40d471147)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f02b91056253e8cdc592888f431da0731337b8,00e1950716c6ed67d74777b2db286b0fa23b4be9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.259,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T07:00:02.936801+00:00", "updated": "2026-10-20T09:15:12.778352+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}