CVE-2026-23395
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
Reported by linux · Published March 25, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Currently the code attempts to accept requests regardless of the command identifier which may cause multiple requests to be marked as pending (FLAG_DEFER_SETUP) which can cause more than L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer causing an overflow. The spec is quite clear that the same identifier shall not be used on subsequent requests: 'Within each signaling channel a different Identifier shall be used for each successive request or indication.' https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d So this attempts to check if there are any channels pending with the same identifier and rejects if any are found.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| linux_kernel | linux | 6.19.10, 6.18.20, 6.12.78, 6.6.130, 6.1.167, 5.15.203, 5.10.253 |
| Linux | Linux | fb4a3a26483f3ea2cd21c7a2f7c45d5670600465, e72ee455297b794b852e5cea8d2d7bb17312172a, 8d0d94f8ba5b3a0beec3b0da558b9bea48018117, 6b949a6b33cbdf621d9fc6f0c48ac00915dbf514, 5b3e2052334f2ff6d5200e952f4aa66994d09899, 2124d82fd25e1671bb3ceb37998af5aae5903e06 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 15f02b91056253e8cdc592888f431da0731337b8, 15f02b91056253e8cdc592888f431da0731337b8, 15f02b91056253e8cdc592888f431da0731337b8 |
| Linux | Linux | 5.7, 0, 5.10.253 |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | 0 |
| linux | linux_kernel | 5.7, 5.7, 5.7 |
| Linux | Linux | 15f02b91056253e8cdc592888f431da0731337b8, 15f02b91056253e8cdc592888f431da0731337b8, 15f02b91056253e8cdc592888f431da0731337b8 |
Timeline
- Mar 24, 2026 CVE Published
- Mar 25, 2026 EPSS Score (30 in total, the first dated here)
- Mar 25, 2026 Coalition ESS Score (2 in total, the first dated here)
- Mar 25, 2026 PoC Published
- Mar 29, 2026 Security Advisory (142 in total, the first dated here)
- Aug 11, 2026 Distribution Patch (59 in total, the first dated here)
- Oct 19, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-23395
vulnetix vdb fixes CVE-2026-23395Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-23395/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart