CVE-2026-63976High· 8.8▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
Last analysed / modified upstream
0.5% → 0.6%
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value.
A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET).
Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).
Linux >= 15f02b91056253e8cdc592888f431da0731337b8 < 59f5ecf6ad5c4db6ae81965a96156954a3b0d89aLinux >= 15f02b91056253e8cdc592888f431da0731337b8 < ae0152d77d101c920769934fb102b18de0c6f526Linux >= 15f02b91056253e8cdc592888f431da0731337b8 < c2afd2613fda90107c5e2fe8e855627451749c78Linux >= 15f02b91056253e8cdc592888f431da0731337b8 < cc2b4f749de09975bfa06e58bbbad2f6acd4c79cLinux >= 15f02b91056253e8cdc592888f431da0731337b8 < 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1Linux >= 15f02b91056253e8cdc592888f431da0731337b8 < f39049304ba655ffcbb92edbdf8c51a1f1210bedLinux >= 15f02b91056253e8cdc592888f431da0731337b8 < 8e7977afaef37c6bd2b2654f1bce6ab40d471147Linux >= 15f02b91056253e8cdc592888f431da0731337b8 < 00e1950716c6ed67d74777b2db286b0fa23b4be9Linux 5.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99253Noneio_uring/cancel: rearm local work wake up before sleep
CVE-2026-99269High· 7.8sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
CVE-2026-99246High· 8.1tipc: protect node reset trace dump with node lock
CVE-2026-99270High· 8.1tcp: Fix potential UAF in reqsk_timer_handler().
CVE-2026-99261Nonedrm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction
CVE-2026-99260Nonentfs: fix resident conversion in ntfs_new_attr_flags