---
id: CVE-2026-23395
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ

  Currently the code attempts to accept requests regardless of the
  command identifier which may cause multi…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ

  Currently the code attempts to accept requests regardless of the
  command identifier which may cause multi…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.7.1, < 5.10.253'
  - 'linux_kernel >= 5.11, < 5.15.203'
  - 'linux_kernel >= 5.16, < 6.1.167'
  - 'linux_kernel >= 6.2, < 6.6.130'
  - 'linux_kernel >= 6.7, < 6.12.78'
  - 'linux_kernel >= 6.13, < 6.18.20'
  - 'linux_kernel >= 6.19, < 6.19.10'
  - linux_kernel = 5.7
  - linux_kernel = 7.0
patched:
  - linux_kernel 6.19.10
published: '2026-03-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:18:54.617'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23395'
references:
  - url: 'https://git.kernel.org/stable/c/10a7a702542240d5edb2b39450ac951c59ccd009'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2124d82fd25e1671bb3ceb37998af5aae5903e06'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/46e5b71666fb7652082e4e214a3365f4b14f1dc3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5b3e2052334f2ff6d5200e952f4aa66994d09899'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6b949a6b33cbdf621d9fc6f0c48ac00915dbf514'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8d0d94f8ba5b3a0beec3b0da558b9bea48018117'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e72ee455297b794b852e5cea8d2d7bb17312172a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fb4a3a26483f3ea2cd21c7a2f7c45d5670600465'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00249
epssPercentile: 0.15107
ingestedAt: '2026-10-15T03:30:12.847Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ

Currently the code attempts to accept requests regardless of the
command identifier which may cause multiple requests to be marked
as pending (FLAG_DEFER_SETUP) which can cause more than
L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer
causing an overflow.

The spec is quite clear that the same identifier shall not be used on
subsequent requests:

'Within each signaling channel a different Identifier shall be used
for each successive request or indication.'
https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d

So this attempts to check if there are any channels pending with the
same identifier and rejects if any are found.

## Affected

- `linux_kernel >= 5.7.1, < 5.10.253`
- `linux_kernel >= 5.11, < 5.15.203`
- `linux_kernel >= 5.16, < 6.1.167`
- `linux_kernel >= 6.2, < 6.6.130`
- `linux_kernel >= 6.7, < 6.12.78`
- `linux_kernel >= 6.13, < 6.18.20`
- `linux_kernel >= 6.19, < 6.19.10`
- `linux_kernel = 5.7`
- `linux_kernel = 7.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.10`