CVE-2026-64127
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel's Bluetooth L2CAP subsystem, a vulnerability was found in the ecred_reconfigure function where a stack pointer was incorrectly passed instead of the packed PDU structure. This causes a kernel address leak to the paired Bluetooth device and breaks the L2CAP_ECRED_RECONFIGURE functionality.
Risk Assessment
The organization is at risk of kernel memory address leakage to a Bluetooth peer, which could aid attacks relying on memory layout knowledge. Additionally, the L2CAP reconfiguration feature is broken, potentially disrupting Bluetooth-dependent applications.
Recommendation
Immediately update the Linux kernel to a version containing the fix that restores correct size and pointer passing for the PDU structure in l2cap_ecred_reconfigure().
Other vulnerabilities in Linux kernel
See all- CVE-2026-80577Unknown
In the Linux kernel's drm/panthor driver, panthor_fw_load_section_entry() skips BO creation for zero-sized firmware sections but adds them to the section list, leading to NULL pointer dereference in later paths. The fix skips adding such sections to the list.
- CVE-2026-80571Unknown
In the Linux kernel powerpc/pseries papr-phy-attest, missing validation of cmd.length could lead to buffer overflow. The fix adds length checks and fixes memory leaks on error paths.
- CVE-2026-80567Unknown
In the Linux kernel Synaptics RMI4 driver (F54), worker errors were not propagated to the V4L2 queue, causing stale or uninitialized data to be delivered to userspace. The fix adds error checking and marks buffers as error state.
- CVE-2026-80566Unknown
In the Linux kernel, the hynitron_cstxxx driver improperly validated touch count and finger IDs. This can lead to corrupted touch state or out-of-bounds buffer access.
- CVE-2026-80564Unknown
In the Linux kernel, the gve driver lacks an implementation of adjfine, leading to a NULL pointer dereference when triggered from userspace, e.g., via testptp.
- CVE-2026-80563Unknown
A use-after-free vulnerability was found in the Linux kernel's gpio-sloppy-logic-analyzer driver. The 'trigger' debugfs file lacked proper protection, allowing a write to freed memory during device unbind. The issue was fixed by using debugfs_create_file() instead of debugfs_create_file_unsafe().
- CVE-2026-80543Unknown
In the Linux kernel, the xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() functions for s390/zcrypt copy a user space message into a kernel buffer based on length, but further processing assumes 4-byte alignment. As a result, up to 3 bytes of uninitialized kernel memory are forwarded to further processing, potentially exposing kernel memory to the crypto card firmware.
- CVE-2026-80542Unknown
In the Linux kernel, the amdgpu driver for AMD Display has a NULL pointer dereference in amdgpu_dm_crtc_set_vblank() when vblank is enabled or queried before a stream is attached to acrtc_state->stream. This can lead to a system crash.
- CVE-2026-80535Unknown
In the Linux kernel XFS filesystem, during directory tree repair, a self-referential directory may be detected. In such a case, the repair code attempts to lock the same inode twice (double iolock/ilock), leading to a deadlock. The fix detects this corner case and handles it appropriately.
- CVE-2026-80533Unknown
In the Linux kernel XFS filesystem, during AGI repair, the function xrep_iunlink_walk_ondisk_bucket may attempt to use the pointer sc->sa.agi_bp, which can be null if the buffer verifier fails. The fix uses ragi->agi_bp instead, which skips verifier checks, to avoid walking off the end of memory.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings") converted the on-stack request PDU in l2cap_ecred_reconfigure() from an explicit packed struct to DEFINE_RAW_FLEX(), but did not adjust the size and source-pointer arguments to l2cap_send_cmd(): - struct { - struct l2cap_ecred_reconf_req req; - __le16 scid; - } pdu; + DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1); ... l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ, sizeof(pdu), &pdu); After the conversion, DEFINE_RAW_FLEX() expands to declare an anonymous union pdu_u plus a local pointer "pdu" pointing at it. Therefore: - sizeof(pdu) is now sizeof(struct l2cap_ecred_reconf_req *) = 8 on 64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]). - &pdu is the address of the local pointer's stack storage, not the address of the request payload. l2cap_send_cmd() forwards (data, count) to l2cap_build_cmd(), which calls skb_put_data(skb, data, count). The L2CAP_ECRED_RECONFIGURE_REQ packet body therefore contains 8 bytes copied from the kernel stack starting at &pdu -- the 8 bytes overlap the pdu pointer's value, leaking a kernel stack address to the paired Bluetooth peer. The intended (mtu, mps, scid) fields are not transmitted at all, so the peer rejects the request as malformed and the L2CAP_ECRED_RECONFIGURE feature itself has been broken for the local-side initiator since the introducing commit landed. The sibling site l2cap_ecred_conn_req() in the same commit was converted correctly (sizeof(*pdu) + len, pdu); only this site was missed. Restore the original semantics: pass the full flex-struct size via struct_size(pdu, scid, 1) and the pdu pointer (the struct address) as the source. Validated on a stock 7.0-based host kernel via the real call path: setsockopt(SOL_BLUETOOTH, BT_RCVMTU, ...) on a BT_CONNECTED L2CAP_MODE_EXT_FLOWCTL socket emits an L2CAP_ECRED_RECONFIGURE_REQ whose body is 8 bytes (the on-stack pdu local's value) rather than the expected 6. Three captures from fresh socket / fresh hciemu peer on the same host -- low bytes vary per call, high 0xffff confirms a kernel virtual address (KASLR-randomised stack slot, not a fixed string): RECONF_REQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff After this patch the body is 6 bytes carrying the expected little-endian (mtu, mps, scid).