Bug 2502346 (CVE-2026-63975)

Summary:	CVE-2026-63975 kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component of the Linux kernel. When a device receives a connection response with an already-assigned destination Channel Identifier (CID), the system may crash. This occurs because the kernel's procedure for discarding both channels in this scenario can lead to incorrect channel deletion, causing instability. This vulnerability can be triggered by a remote attacker sending a specially crafted Bluetooth L2CAP packet, potentially leading to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 16:03:08 UTC

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

If dcid is received for an already-assigned destination CID the spec
requires that both channels to be discarded, but calling l2cap_chan_del
may invalidate the tmp cursor created by list_for_each_entry_safe and
in fact it is the wrong procedure as the chan->dcid may be assigned
previously it really needs to be disconnected.

Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so
instead schedule l2cap_chan_timeout with delay 0 to close the channel
asynchronously.

Comment 1 Keith Grant 2026-07-21 23:09:48 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071900-CVE-2026-63975-635f@gregkh/T

Comment 6 errata-xmlrpc 2026-09-08 11:35:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:65334 https://access.redhat.com/errata/RHSA-2026:65334