CVE-2026-23395

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ

Currently the code attempts to accept requests regardless of the

command identifier which may cause multiple requests to be marked

as pending (FLAG_DEFER_SETUP) which can cause more than

L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer

causing an overflow.

The spec is quite clear that the same identifier shall not be used on

subsequent requests:

'Within each signaling channel a different Identifier shall be used

for each successive request or indication.'

https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d

So this attempts to check if there are any channels pending with the

same identifier and rejects if any are found.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References