CVE-2026-64127

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer

Commit 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end

warnings") converted the on-stack request PDU in l2cap_ecred_reconfigure()

from an explicit packed struct to DEFINE_RAW_FLEX(), but did not adjust the

size and source-pointer arguments to l2cap_send_cmd():

- struct {

- struct l2cap_ecred_reconf_req req;

- __le16 scid;

- } pdu;

+ DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1);

...

l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,

sizeof(pdu), &pdu);

After the conversion, DEFINE_RAW_FLEX() expands to declare an anonymous

union pdu_u plus a local pointer "pdu" pointing at it. Therefore:

- sizeof(pdu) is now sizeof(struct l2cap_ecred_reconf_req *) = 8 on

64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]).

-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References