VulnerabilityPublished 19 Jul 2026Updated 6 Nov 2026

CVE-2026-64127: Linux kernel · Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ed5fcd2a26f0c16fc289c8cd6b03328a0582a687 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:49 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in ed5fcd2a26f0c16fc289c8cd6b03328a0582a687, 051922ab709c0a6917eae765c22481dfc68379e5, 3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d +1

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to ed5fcd2a26f0c16fc289c8cd6b03328a0582a687, 051922ab709c0a6917eae765c22481dfc68379e5, 3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d or 356c9d1a1cbacd2a1640fff3c050e1c3472e924f.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1c08108f3014881ad5f4c35a2abaf9c65475035d, < ed5fcd2a26f0c16fc289c8cd6b03328a0582a687	Fixed in ed5fcd2a26f0c16fc289c8cd6b03328a0582a687
LinuxLinux	Affected ≥ 1c08108f3014881ad5f4c35a2abaf9c65475035d, < 051922ab709c0a6917eae765c22481dfc68379e5	Fixed in 051922ab709c0a6917eae765c22481dfc68379e5
LinuxLinux	Affected ≥ 1c08108f3014881ad5f4c35a2abaf9c65475035d, < 3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d	Fixed in 3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d
LinuxLinux	Affected ≥ 1c08108f3014881ad5f4c35a2abaf9c65475035d, < 356c9d1a1cbacd2a1640fff3c050e1c3472e924f	Fixed in 356c9d1a1cbacd2a1640fff3c050e1c3472e924f
LinuxLinux	Affected =6.10	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings") converted the on-stack request PDU in l2cap_ecred_reconfigure() from an explicit packed struct to DEFINE_RAW_FLEX(), but did not adjust the size and source-pointer arguments to l2cap_send_cmd(): - struct { - struct l2cap_ecred_reconf_req req; - __le16 scid; - } pdu; + DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1); ... l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ, sizeof(pdu), &pdu); After the conversion, DEFINE_RAW_FLEX() expands to declare an anonymous union pdu_u plus a local pointer "pdu" pointing at it. Therefore: - sizeof(pdu) is now sizeof(struct l2cap_ecred_reconf_req *) = 8 on 64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]). - &pdu is the address of the local pointer's stack storage, not the address of the request payload. l2cap_send_cmd() forwards (data, count) to l2cap_build_cmd(), which calls skb_put_data(skb, data, count). The L2CAP_ECRED_RECONFIGURE_REQ packet body therefore contains 8 bytes copied from the kernel stack starting at &pdu -- the 8 bytes overlap the pdu pointer's value, leaking a kernel stack address to the paired Bluetooth peer. The intended (mtu, mps, scid) fields are not transmitted at all, so the peer rejects the request as malformed and the L2CAP_ECRED_RECONFIGURE feature itself has been broken for the local-side initiator since the introducing commit landed. The sibling site l2cap_ecred_conn_req() in the same commit was converted correctly (sizeof(*pdu) + len, pdu); only this site was missed. Restore the original semantics: pass the full flex-struct size via struct_size(pdu, scid, 1) and the pdu pointer (the struct address) as the source. Validated on a stock 7.0-based host kernel via the real call path: setsockopt(SOL_BLUETOOTH, BT_RCVMTU, ...) on a BT_CONNECTED L2CAP_MODE_EXT_FLOWCTL socket emits an L2CAP_ECRED_RECONFIGURE_REQ whose body is 8 bytes (the on-stack pdu local's value) rather than the expected 6. Three captures from fresh socket / fresh hciemu peer on the same host -- low bytes vary per call, high 0xffff confirms a kernel virtual address (KASLR-randomised stack slot, not a fixed string): RECONF_REQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff After this patch the body is 6 bytes carrying the expected little-endian (mtu, mps, scid).

References

Community reviews

Loading reviews…