CVE-2026-63976: Linux Kernel Bluetooth L2CAP DoS Flaw

CVE-2026-63976 Overview

CVE-2026-63976 is a Linux kernel vulnerability in the Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) subsystem. The l2cap_ecred_reconf_rsp() function returns early on a successful Enhanced Credit Based Flow Control (ECRED) reconfiguration without clearing chan->ident. A remote attacker on the adjacent Bluetooth network can replay a failure response with the stale identifier, causing the kernel to destroy an already-established L2CAP channel through l2cap_chan_del(chan, ECONNRESET). The flaw allows an in-range attacker to disrupt or corrupt Bluetooth channel state without authentication or user interaction.

Critical Impact
A remote attacker within Bluetooth range can replay a crafted L2CAP failure response to tear down an established channel, resulting in denial of service and potential channel state corruption in the kernel.

Affected Products

Linux kernel Bluetooth L2CAP subsystem (net/bluetooth/l2cap_core.c)
Distributions shipping affected upstream kernel versions prior to the fix commits
Systems with Bluetooth hardware enabled supporting LE Enhanced Credit Based Flow Control

Discovery Timeline

2026-07-19 - CVE-2026-63976 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63976

Vulnerability Analysis

The vulnerability resides in the L2CAP handler l2cap_ecred_reconf_rsp() within the Linux kernel Bluetooth stack. On a successful ECRED reconfiguration transaction, the handler returns early without resetting chan->ident to zero. Every peer L2CAP response handler, including l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, and l2cap_config_rsp, clears chan->ident after a successful transaction. This prevents subsequent responses from matching the channel using a recycled identifier value.

Because the identifier persists after success, the channel remains discoverable through __l2cap_get_chan_by_ident() lookups. An attacker who completed the reconfiguration as a legitimate peer can then send a crafted failure response carrying the stale identifier. The kernel matches this response to the still-established channel and invokes l2cap_chan_del(chan, ECONNRESET), destroying an active channel.

Root Cause

The root cause is missing state cleanup in a protocol response handler. The chan->ident field is intended as a transient correlation token between a request and its response. Failing to clear it after ECRED reconfiguration success leaves the channel matchable indefinitely, violating the invariant maintained by sibling handlers. Compounding the issue, the failure path did not use l2cap_chan_hold_unless_zero() consistent with l2cap_le_command_rej and __l2cap_get_chan_by_ident, allowing unsafe reference handling.

Attack Vector

Exploitation requires adjacent network access over Bluetooth. The attacker completes a legitimate ECRED reconfiguration as the peer, retains knowledge of the ident value, then transmits an L2CAP reconfiguration failure response reusing that ident. The victim kernel matches the response to the live channel and tears it down with ECONNRESET, disrupting the Bluetooth connection and destabilizing dependent services. No authentication or user interaction is required beyond completing normal L2CAP peer negotiation.

Refer to the upstream fixes in the Kernel Git Commit f390493 and Kernel Git Commit ae0152d for the exact code changes applied to l2cap_core.c.

Detection Methods for CVE-2026-63976

Indicators of Compromise

Unexpected Bluetooth L2CAP channel teardown events logged with ECONNRESET reason codes in kernel ring buffers.
dmesg entries showing repeated L2CAP reconfiguration failures shortly after successful ECRED reconfiguration.
Anomalous Bluetooth disconnections on paired peripherals such as headsets, medical devices, or industrial IoT sensors.

Detection Strategies

Monitor kernel logs for L2CAP disconnection events correlated with recent ECRED reconfiguration signaling.
Capture Bluetooth HCI (Host Controller Interface) traces using btmon on suspect hosts to inspect L2CAP signaling frames and identify replayed ident values.
Track kernel versions across the fleet and flag hosts running Bluetooth-enabled kernels lacking the referenced upstream patch commits.

Monitoring Recommendations

Ingest kernel and syslog messages into a centralized data lake to surface abnormal Bluetooth channel resets at scale.
Alert on Bluetooth service crashes or repeated reconnection attempts on managed endpoints running Linux.
Correlate physical proximity signals with disconnection spikes to identify possible adjacent-range attackers.

How to Mitigate CVE-2026-63976

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD advisory across all affected hosts.
Disable Bluetooth on servers, workstations, and embedded devices where the radio is not operationally required.
Inventory Bluetooth-enabled Linux systems and prioritize patching for devices operating in shared physical spaces.

Patch Information

Upstream fixes are available in the mainline and stable trees. The relevant commits include Kernel Git Commit 00e1950, Kernel Git Commit 3b5b5f4, Kernel Git Commit 59f5ecf, Kernel Git Commit 8e7977a, Kernel Git Commit ae0152d, Kernel Git Commit c2afd26, Kernel Git Commit cc2b4f7, and Kernel Git Commit f390493. The fixes clear chan->ident for all matching channels on success and adopt l2cap_chan_hold_unless_zero() on the failure path.

Workarounds

Unload the Bluetooth kernel modules on systems that do not require Bluetooth: rmmod bluetooth btusb.
Blacklist the Bluetooth modules in /etc/modprobe.d/ to prevent automatic loading on reboot until patches are deployed.
Restrict device pairing to trusted peripherals and disable discoverable mode to reduce adjacent attack surface.

bash

# Configuration example: disable Bluetooth on unpatched Linux hosts
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
echo "blacklist bluetooth" | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo "blacklist btusb" | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo rmmod btusb bluetooth 2>/dev/null || true