CVE-2026-23395

HIGH EPSS 16.1%
Published Mar 25, 20263mo ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Mar 25, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Currently the code attempts to accept requests regardless of the command identifier which may cause multiple requests to be marked as pending (FLAG_DEFER_SETUP) which can cause more than L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer causing an overflow. The spec is quite clear that the same identifier shall not be used on subsequent requests: 'Within each signaling channel a different Identifier shall be used for each successive request or indication.' https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d So this attempts to check if there are any channels pending with the same identifier and rejects if any are found.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Adjacent
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
16.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 15

VendorProductVersionRange
linuxlinux_kernel*≥5.7.1  –  <5.10.253
linuxlinux_kernel*≥5.11  –  <5.15.203
linuxlinux_kernel*≥5.16  –  <6.1.167
linuxlinux_kernel*≥6.2  –  <6.6.130
linuxlinux_kernel*≥6.7  –  <6.12.78
linuxlinux_kernel*≥6.13  –  <6.18.20
linuxlinux_kernel*≥6.19  –  <6.19.10
linuxlinux_kernel5.7any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any

References 8

  • git.kernel.org https://git.kernel.org/stable/c/10a7a702542240d5edb2b39450ac951c59ccd009
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2124d82fd25e1671bb3ceb37998af5aae5903e06
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/46e5b71666fb7652082e4e214a3365f4b14f1dc3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5b3e2052334f2ff6d5200e952f4aa66994d09899
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6b949a6b33cbdf621d9fc6f0c48ac00915dbf514
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8d0d94f8ba5b3a0beec3b0da558b9bea48018117
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e72ee455297b794b852e5cea8d2d7bb17312172a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fb4a3a26483f3ea2cd21c7a2f7c45d5670600465
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/10a7a702542240d5edb2b39450ac951c59ccd009
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2124d82fd25e1671bb3ceb37998af5aae5903e06
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/46e5b71666fb7652082e4e214a3365f4b14f1dc3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5b3e2052334f2ff6d5200e952f4aa66994d09899
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6b949a6b33cbdf621d9fc6f0c48ac00915dbf514
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8d0d94f8ba5b3a0beec3b0da558b9bea48018117
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e72ee455297b794b852e5cea8d2d7bb17312172a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fb4a3a26483f3ea2cd21c7a2f7c45d5670600465
    Patch