CVE-2026-43062: Linux Kernel Bluetooth L2CAP Vulnerability

CVE-2026-43062 Overview

CVE-2026-43062 is a type confusion vulnerability in the Linux kernel Bluetooth subsystem, specifically in the L2CAP (Logical Link Control and Adaptation Protocol) handler l2cap_ecred_reconf_rsp(). The function incorrectly casts incoming data to struct l2cap_ecred_conn_rsp (8 bytes, result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes, result at offset 0). This mismatch causes valid L2CAP_ECRED_RECONF_RSP packets to be rejected with -EPROTO and reads response result data from an incorrect memory offset. The issue has been resolved in mainline Linux kernel.

Critical Impact
Type confusion in Bluetooth L2CAP processing causes valid Enhanced Credit Based Flow Control (ECRED) reconfiguration responses to be rejected and produces incorrect result values from out-of-bounds field reads.

Affected Products

Linux kernel Bluetooth subsystem (L2CAP module)
Linux distributions shipping affected kernel versions prior to the upstream fix
Systems with Bluetooth enabled using LE Credit Based Flow Control reconfiguration

Discovery Timeline

2026-05-05 - CVE-2026-43062 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43062

Vulnerability Analysis

The defect resides in the l2cap_ecred_reconf_rsp() handler within the Linux kernel's Bluetooth L2CAP implementation. The function processes responses to Enhanced Credit Based Flow Control (ECRED) reconfiguration requests. Instead of casting the incoming response buffer to struct l2cap_ecred_reconf_rsp, the code casts it to struct l2cap_ecred_conn_rsp, which is a different protocol message structure used for connection responses.

This type confusion produces two concrete defects. First, the sizeof(*rsp) length validation enforces a minimum of 8 bytes when the correct minimum is 2 bytes, so well-formed reconfiguration responses are rejected with -EPROTO. Second, when a packet is large enough to pass the oversized length check, rsp->result is read from offset 6 instead of offset 0, returning attacker-controlled or unrelated data as the protocol result code.

Root Cause

The root cause is incorrect structure type assignment when parsing inbound L2CAP signalling PDUs. The handler reuses the connection-response structure layout for a reconfiguration response, conflating two distinct protocol message formats defined by the Bluetooth Core Specification.

Attack Vector

A Bluetooth peer within radio range that can establish or has established an L2CAP LE Credit Based connection can send crafted L2CAP_ECRED_RECONF_RSP packets. The misinterpretation of the response payload can corrupt the L2CAP connection state machine, cause protocol-level denial of service against legitimate ECRED reconfiguration, and surface incorrect result values to callers relying on the parsed field.

No verified public proof-of-concept code is associated with this CVE. The vulnerability mechanism is described in the upstream commit messages referenced under Linux Kernel Commit dd3b221 and related stable backports.

Detection Methods for CVE-2026-43062

Indicators of Compromise

Kernel log entries showing -EPROTO rejections from L2CAP signalling on otherwise valid ECRED reconfiguration exchanges.
Repeated failed Bluetooth L2CAP reconfiguration attempts from the same remote device address.
Anomalous BT_DBG traces referencing l2cap_ecred_reconf_rsp with malformed result values.

Detection Strategies

Inventory running kernel versions across Linux endpoints and compare against fixed versions referenced in the upstream stable commits.
Monitor dmesg and journalctl -k output for unexpected Bluetooth L2CAP protocol errors on systems with Bluetooth enabled.
Capture HCI traces with btmon on suspect systems to identify malformed or anomalous ECRED reconfiguration response frames.

Monitoring Recommendations

Centralize kernel log collection and alert on bursts of L2CAP -EPROTO errors associated with Bluetooth peer addresses.
Track Bluetooth pairing and connection events from untrusted devices in environments where Bluetooth is permitted.
Correlate Bluetooth subsystem warnings with proximity-based asset telemetry to identify potential local attackers.

How to Mitigate CVE-2026-43062

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits, or update to a distribution kernel that includes the fix.
Disable the Bluetooth subsystem on systems that do not require it by unloading the bluetooth and related kernel modules.
Restrict Bluetooth pairing to known devices and disable discoverability on production endpoints.

Patch Information

The fix replaces the incorrect cast with struct l2cap_ecred_reconf_rsp so that the length check requires only 2 bytes and rsp->result is read from offset 0. The patch also passes the byte-swapped result variable to BT_DBG rather than the raw __le16 field. Patches are available in the following commits: Linux Kernel Commit 111f745, Linux Kernel Commit 1514567, Linux Kernel Commit 21d3ba6, Linux Kernel Commit 3b94e62, Linux Kernel Commit 5a1ea29, Linux Kernel Commit d90150c, Linux Kernel Commit dd3b221, and Linux Kernel Commit f110b8f.

Workarounds

Disable Bluetooth at the firmware or OS level on servers and workstations that do not require it.
Block loading of the bluetooth kernel module via /etc/modprobe.d/ blacklist entries on hardened systems.
Limit physical and radio proximity exposure for Bluetooth-enabled endpoints in sensitive environments.

bash

# Configuration example: blacklist Bluetooth modules until patched
echo "blacklist bluetooth" | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo "blacklist btusb" | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo systemctl disable --now bluetooth.service
sudo modprobe -r btusb bluetooth 2>/dev/null || true

# Verify current kernel version against patched stable releases
uname -r