The vulnerability in the Linux kernel Bluetooth L2CAP ecred_reconfigure function stems from a code change that converted an on-stack request PDU from a packed struct to a flexible array macro (DEFINE_RAW_FLEX) without adjusting the size and pointer arguments passed to l2cap_send_cmd(). This caused the function to send the size of a pointer (8 bytes on 64-bit) and the address of the pointer variable on the stack instead of the actual payload data. Consequently, the L2CAP_ECRED_RECONFIGURE_REQ packet sent to the Bluetooth peer contained 8 bytes copied from the kernel stack, leaking a kernel stack address. The patch restores the original semantics by passing the correct size and pointer to the payload, fixing the information leak and restoring the feature's functionality.

The vulnerability leaks kernel stack memory, including a kernel stack address, to a paired Bluetooth device. This information disclosure could aid an attacker in bypassing kernel address space layout randomization (KASLR) or other kernel memory protections. The malformed packet also causes the L2CAP_ECRED_RECONFIGURE feature to break for the local initiator, impacting Bluetooth functionality.

A patch has been applied to the Linux kernel that corrects the size and pointer arguments in the Bluetooth L2CAP ecred_reconfigure function, preventing kernel stack memory leakage and restoring proper feature operation. Users should update to the fixed kernel version once available. Patch status is not explicitly stated in the input data; check the vendor advisory for current remediation guidance.