CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
Vulnerability summary
CVE-2026-23395 is a high (CVSS 8.8) Improper Input Validation vulnerability in linux. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 19.7% of scored vulnerabilities.
Not severe (CVSS 8.8, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 34 · Related 32Timeline
- 25-03-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Currently the code attempts to accept requests regardless of the command identifier which may cause multiple requests to be marked as pending (FLAG_DEFER_SETUP) which can cause more than L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer causing an overflow. The spec is quite clear that the same identifier shall not be used on subsequent requests: 'Within each signaling channel a different Identifier shall be used for each successive request or indication.' https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d So this attempts to check if there are any channels pending with the same identifier and rejects if any are found.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
Increase +0.02 pp
From 0.25% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu145 products
- linux< 5.15.0-186.196 | < 6.8.0-136.136 | All versions (No fix recorded)
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 5.15.0-1112.119 | < 6.8.0-1061.64 | All versions (No fix recorded)
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 15f02b91056253e8cdc592888f431da0731337b8, < 10a7a702542240d5edb2b39450ac951c59ccd009 | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < 46e5b71666fb7652082e4e214a3365f4b14f1dc3 | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < fb4a3a26483f3ea2cd21c7a2f7c45d5670600465 | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < 2124d82fd25e1671bb3ceb37998af5aae5903e06 | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < 6b949a6b33cbdf621d9fc6f0c48ac00915dbf514 | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < 8d0d94f8ba5b3a0beec3b0da558b9bea48018117 | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < e72ee455297b794b852e5cea8d2d7bb17312172a | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < 5b3e2052334f2ff6d5200e952f4aa66994d09899 | 5.7
- linux_kernel≥ 5.7.1, < 5.10.253 | ≥ 5.11, < 5.15.203 | ≥ 5.16, < 6.1.167 | ≥ 6.2, < 6.6.130 | ≥ 6.7, < 6.12.78 | ≥ 6.13, < 6.18.20 | ≥ 6.19, < 6.19.10 | 5.7 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6 | 7.0:rc7
Debian1 product
- linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.10-1
3 vendors · 148 products
