The vulnerability CVE-2026-64127 in the Linux kernel's Bluetooth L2CAP subsystem arises from an incorrect update to the ecred_reconfigure function. A commit replaced an explicit packed struct with a DEFINE_RAW_FLEX macro but failed to update the size and source-pointer arguments passed to l2cap_send_cmd(). As a result, the function sent 8 bytes from the kernel stack representing the pointer's address rather than the intended 6-byte request payload (mtu, mps, scid). This causes a kernel stack address leak to the paired Bluetooth device and breaks the L2CAP_ECRED_RECONFIGURE feature for the local initiator. The issue was fixed by restoring the original semantics, passing the correct size and pointer to the payload. The vulnerability has a CVSS 3.1 base score of 5.5 (medium severity) with local attack vector, low privileges required, no user interaction, and an impact on availability only.

The vulnerability leaks kernel stack memory addresses to a paired Bluetooth peer, which can aid in bypassing kernel address space layout randomization (KASLR) protections. The flaw does not impact confidentiality or integrity directly but causes the L2CAP_ECRED_RECONFIGURE feature to malfunction, resulting in denial of service for that feature on the local initiator side. There is no indication of remote code execution or privilege escalation from this issue. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to correct the size and pointer arguments passed to l2cap_send_cmd() in the ecred_reconfigure function, restoring the proper transmission of the request payload and preventing kernel stack address leakage. Users should apply the official Linux kernel patch that addresses this issue. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel mailing lists for the current remediation guidance and updated kernel versions containing the fix.