In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received… (CVE-2026-63975)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan->dcid may be assigned previously it really needs to be disconnected. Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously.
AI Analysis
Technical Summary
The Linux kernel Bluetooth L2CAP subsystem had a vulnerability where receiving a dcid for an already-assigned destination CID caused improper channel deletion. The original approach called l2cap_chan_del directly, which could invalidate internal list cursors and was incorrect per the specification. The fix involves scheduling l2cap_chan_timeout with zero delay to close the channel asynchronously, preventing crashes caused by premature channel deletion.
Potential Impact
This vulnerability could lead to a kernel crash when processing certain Bluetooth L2CAP connection responses, potentially causing denial of service on affected systems. There is no indication of code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by modifying the channel closure method. Users should apply the official Linux kernel updates that include this patch once available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received… (CVE-2026-63975)
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan->dcid may be assigned previously it really needs to be disconnected. Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel Bluetooth L2CAP subsystem had a vulnerability where receiving a dcid for an already-assigned destination CID caused improper channel deletion. The original approach called l2cap_chan_del directly, which could invalidate internal list cursors and was incorrect per the specification. The fix involves scheduling l2cap_chan_timeout with zero delay to close the channel asynchronously, preventing crashes caused by premature channel deletion.
Potential Impact
This vulnerability could lead to a kernel crash when processing certain Bluetooth L2CAP connection responses, potentially causing denial of service on affected systems. There is no indication of code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by modifying the channel closure method. Users should apply the official Linux kernel updates that include this patch once available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-g36p-q7h2-h3pp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63975"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27aa2a4a8d598912df04
Added to database: 07/19/2026, 19:38:18 UTC
Last enriched: 07/19/2026, 20:01:49 UTC
Last updated: 07/20/2026, 21:51:47 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.