CVE-2026-72333

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix tx ident leak for commands without a response

Commit 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding

TX ident") changed ident allocation to use an IDA, releasing idents in

l2cap_put_ident() when the matching response command is received.

But identifiers allocated for commands that have no response defined

are never released. In particular L2CAP_LE_CREDITS is sent repeatedly for

the lifetime of an LE CoC channel, so a peer streaming data to the

host exhausts the 1-255 ident range after 254 credit packets. From

then on l2cap_get_ident() fails:

kernel: Bluetooth: Unable to allocate ident: -28

and every subsequent L2CAP_LE_CREDITS packet is sent with ident 0,

which is invalid (Core Spec, Vol 3, Part A, Section 4: "Signaling

identifier 0x00 is an invalid identifier and shall never be used in

any command"). Remote stacks that validate the ident drop these

commands, never receive n

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References