CVE-2026-23395: Linux Kernel Bluetooth Buffer Overflow

CVE-2026-23395 Overview

A buffer overflow vulnerability has been identified in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation. The vulnerability exists in the handling of L2CAP Enhanced Credit Based Flow Control connection requests (L2CAP_ECRED_CONN_REQ). The code incorrectly accepts multiple connection requests regardless of the command identifier, causing multiple requests to be marked as pending with the FLAG_DEFER_SETUP flag. This can result in more than L2CAP_ECRED_MAX_CID(5) channels being allocated in l2cap_ecred_rsp_defer, causing a buffer overflow.

Critical Impact

An attacker within Bluetooth range could exploit this vulnerability by sending multiple L2CAP Enhanced Credit connection requests with the same identifier, potentially causing memory corruption and system instability.

Affected Products

• Linux Kernel (multiple versions with Bluetooth L2CAP support)

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23395 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23395

Vulnerability Analysis

The vulnerability stems from a violation of the Bluetooth Core Specification, which mandates that within each signaling channel, a different identifier must be used for each successive request or indication. The affected Linux kernel code fails to validate that incoming L2CAP_ECRED_CONN_REQ requests use unique command identifiers.

When an attacker sends multiple connection requests with the same identifier, the kernel marks all of them as pending with the FLAG_DEFER_SETUP flag. This leads to the allocation of more channel identifiers (CIDs) than the defined maximum of 5 (L2CAP_ECRED_MAX_CID) in the l2cap_ecred_rsp_defer function. The resulting buffer overflow can corrupt adjacent memory structures, potentially leading to kernel crashes or other undefined behavior.

Root Cause

The root cause is improper input validation in the L2CAP signaling layer. The kernel code processes L2CAP_ECRED_CONN_REQ commands without verifying whether channels with the same command identifier are already pending. According to the Bluetooth Core Specification, each successive request must use a different identifier, but this constraint was not enforced.

Attack Vector

An attacker within Bluetooth range of a vulnerable Linux system can exploit this vulnerability by:

1. Establishing a Bluetooth connection with the target device
2. Sending multiple L2CAP_ECRED_CONN_REQ requests using the same command identifier
3. Each request is incorrectly accepted and marked as pending
4. When more than 5 CIDs are allocated, a buffer overflow occurs in l2cap_ecred_rsp_defer

The fix implemented by the kernel developers adds a check for any channels pending with the same identifier, rejecting duplicate requests to prevent the overflow condition.

Detection Methods for CVE-2026-23395

Indicators of Compromise

• Unexpected kernel crashes or panics related to Bluetooth subsystem
• Anomalous L2CAP connection request patterns in Bluetooth logs
• System instability when Bluetooth devices are in proximity

Detection Strategies

• Monitor kernel logs for L2CAP-related errors or warnings using dmesg | grep -i l2cap
• Deploy kernel-level monitoring for unusual Bluetooth connection patterns
• Utilize host-based intrusion detection systems (HIDS) to detect anomalous Bluetooth activity

Monitoring Recommendations

• Enable Bluetooth subsystem debug logging to capture detailed L2CAP signaling information
• Implement continuous monitoring of Bluetooth-enabled systems for unexpected crashes
• Review /var/log/kern.log and /var/log/syslog for Bluetooth-related anomalies

How to Mitigate CVE-2026-23395

Immediate Actions Required

• Update the Linux kernel to a patched version immediately
• If patching is not immediately possible, disable Bluetooth functionality on affected systems
• Limit Bluetooth discoverability and pairing to trusted devices only
• Monitor systems for signs of exploitation until patches can be applied

Patch Information

Multiple kernel patches have been released to address this vulnerability. The fix adds validation to check if there are any channels pending with the same identifier before accepting new connection requests. Relevant kernel commits include:

• Linux Kernel Commit 2124d82
• Linux Kernel Commit 5b3e205
• Linux Kernel Commit 6b949a6
• Linux Kernel Commit 8d0d94f
• Linux Kernel Commit e72ee45
• Linux Kernel Commit fb4a3a2

Workarounds

• Disable Bluetooth at the system level using rfkill block bluetooth
• Remove or blacklist Bluetooth kernel modules (btusb, bluetooth) if not required
• Implement network segmentation to isolate Bluetooth-enabled systems from sensitive environments

# Disable Bluetooth temporarily
sudo rfkill block bluetooth

# Blacklist Bluetooth modules (permanent)
echo "blacklist btusb" | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo "blacklist bluetooth" | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf

# Verify Bluetooth is disabled
rfkill list bluetooth