CVE-2026-63975: Linux Kernel Bluetooth L2CAP DoS Flaw

CVE-2026-63975 Overview

CVE-2026-63975 is a Linux kernel vulnerability in the Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) subsystem. The flaw resides in the l2cap_ecred_conn_rsp function, which handles Enhanced Credit-Based Flow Control connection responses. When a destination Channel Identifier (dcid) is received for an already-assigned CID, the specification requires both channels to be discarded. The kernel handled this by calling l2cap_chan_del, which could invalidate the tmp cursor used by list_for_each_entry_safe, leading to a possible crash or memory corruption. An adjacent attacker within Bluetooth range can trigger the condition through crafted L2CAP frames.

Critical Impact
An adjacent attacker within Bluetooth range can crash the Linux kernel or potentially corrupt memory through malformed L2CAP Enhanced Credit-Based Connection responses, impacting availability, confidentiality, and integrity.

Affected Products

Linux Kernel (Bluetooth L2CAP subsystem)
Stable branches referenced in the fix commits published on git.kernel.org
Distributions shipping unpatched Linux kernels with Bluetooth enabled

Discovery Timeline

2026-07-19 - CVE-2026-63975 published to the National Vulnerability Database (NVD)
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63975

Vulnerability Analysis

The vulnerability exists in the kernel's Bluetooth L2CAP handling of Enhanced Credit-Based Connection (ECRED) responses. The l2cap_ecred_conn_rsp function processes lists of channels using the list_for_each_entry_safe macro. When a peer returns a destination CID that is already assigned locally, the specification mandates that both channels be discarded. The original code path invoked l2cap_chan_del on the affected channel directly inside the iteration.

The direct deletion can invalidate the tmp cursor maintained by list_for_each_entry_safe, breaking the safe-iteration invariant. Subsequent list operations may then dereference freed or altered list nodes. Additionally, calling l2cap_chan_clone in-line can itself lead to l2cap_chan_del being invoked, compounding the unsafe state.

The upstream fix replaces the immediate deletion with an asynchronous scheduling of l2cap_chan_timeout with a delay of zero, allowing the channel to close outside the current iteration context.

Root Cause

The root cause is unsafe list traversal in l2cap_ecred_conn_rsp. The routine mutates the channel list while iterating it, breaking assumptions made by list_for_each_entry_safe. Combined with the incorrect handling of a previously-assigned chan->dcid, this results in a use-after-free or list corruption condition typical of kernel memory-safety bugs in concurrent link-layer paths.

Attack Vector

Exploitation requires adjacent network access over Bluetooth. An attacker within radio range of a vulnerable host sends crafted L2CAP ECRED Connection Response frames referencing a dcid that is already assigned on the target. Processing the malformed response triggers the unsafe list mutation and may crash the kernel or corrupt neighboring channel state. No authentication or user interaction is required.

No public proof-of-concept is available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are documented in the Linux Kernel Commit Log.

Detection Methods for CVE-2026-63975

Indicators of Compromise

Unexpected kernel oops or panic messages referencing l2cap_ecred_conn_rsp, l2cap_chan_del, or list_for_each_entry_safe in dmesg or /var/log/kern.log.
Sudden Bluetooth stack resets or hci0 interface flapping following incoming ECRED connection traffic.
KASAN or slab corruption reports naming L2CAP channel structures.

Detection Strategies

Monitor kernel ring buffer for stack traces originating in the net/bluetooth/l2cap_core.c code paths.
Correlate Bluetooth pairing or connection events with subsequent kernel crashes on hosts running vulnerable kernel versions.
Track kernel version inventory against the fix commits listed on git.kernel.org to identify unpatched systems.

Monitoring Recommendations

Enable persistent crash collection (kdump, systemd-coredump) to capture kernel panics for post-incident analysis.
Aggregate dmesg output into centralized logging and alert on Bluetooth subsystem faults.
On devices where Bluetooth is not required, alert on any load of the bluetooth or btusb kernel modules.

How to Mitigate CVE-2026-63975

Immediate Actions Required

Update the Linux kernel to a stable release that includes the L2CAP fix commits referenced in the NVD entry.
On systems that do not require Bluetooth, disable and blacklist the Bluetooth stack until patches are deployed.
Restrict physical and radio-frequency proximity to critical assets to limit adjacent-network exposure.

Patch Information

The fix schedules l2cap_chan_timeout with a zero delay to close the affected channel asynchronously, avoiding mutation of the list during safe iteration. The change is present in the following stable commits: 291eec1041c9, 3c8eaa91eb43, 41c2713b204e, 41e29548b5e8, 6319b38fe69f, d153b8898c00, e6833e737a51, and ecfed1e0d8ef. Consult the Linux Kernel Commit Log and distribution security trackers for the appropriate backport for your kernel branch.

Workarounds

Unload the Bluetooth kernel modules (rmmod bluetooth btusb) on systems where Bluetooth is not required.
Disable Bluetooth radios in firmware or via rfkill block bluetooth on servers and fixed-function devices.
Blacklist Bluetooth modules in /etc/modprobe.d/ to prevent auto-loading until a patched kernel is installed.

bash

# Configuration example: disable Bluetooth stack on systems that do not need it
sudo rfkill block bluetooth
sudo systemctl disable --now bluetooth.service
echo "blacklist bluetooth" | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo "blacklist btusb"     | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo update-initramfs -u