The Linux kernel Bluetooth L2CAP code did not clear the channel identifier (chan->ident) after a successful ECRED reconfiguration response, unlike other L2CAP response handlers. This allowed a remote attacker, after completing a reconfiguration as the peer, to replay a failure response using the stale identifier. The kernel would then match this stale identifier to an existing channel and delete it via l2cap_chan_del(chan, ECONNRESET), disrupting the established connection. The fix involves clearing chan->ident for all matching channels on success and hardening the failure path by using l2cap_chan_hold_unless_zero() consistent with other handlers.

A remote attacker who has completed a Bluetooth L2CAP ECRED reconfiguration can replay failure responses with stale identifiers to cause the kernel to delete active Bluetooth channels unexpectedly. This results in denial of service by disrupting established Bluetooth connections.

A fix has been implemented in the Linux kernel to clear chan->ident on successful ECRED reconfiguration and to harden the failure handling path. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the Linux kernel vendor advisory for current patch availability and guidance.