CVE-2026-64127
Medium · 5.5CVSS
5.5
EPSS
0.1%
Published
Jul 19, 2026
CISA due date
—
Cloudanix analysis
A mistake in the Linux kernel's Bluetooth code can send internal memory addresses to nearby devices and stop certain connection adjustments from working.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Information Disclosure
- Remediation
- Patch
- Effort
- Low
- Patch risk
- Low
What it actually does
Incorrect pointer and size arguments passed to l2cap_send_cmd in l2cap_ecred_reconfigure cause an 8-byte kernel stack address to be copied into an L2CAP_ECRED_RECONF_REQ packet instead of the intended 6-byte (mtu, mps, scid) payload, disclosing a KASLR-randomized kernel address to the remote peer while also rendering the extended credit-based flow control reconfigure operation non-functional.
Why it matters to the business
Bluetooth devices using Linux kernels may leak sensitive kernel memory layout information to paired peers and experience failures in dynamic L2CAP channel parameter negotiation, potentially affecting reliability of Bluetooth audio, input, or networking stacks until the kernel is updated.
How an attack unfolds
An attacker with local access pairs a Bluetooth device or uses a malicious peer; creates an L2CAP socket in EXT_FLOWCTL mode, connects it, then issues setsockopt calls that trigger l2cap_ecred_reconfigure; the kernel sends an L2CAP packet containing raw stack bytes that include a kernel virtual address, which the attacker observes in the received malformed request response.
How to fix it
Apply the upstream fix that restores correct struct_size(pdu, scid, 1) and pdu pointer arguments to l2cap_send_cmd in l2cap_ecred_reconfigure; rebuild and deploy an updated Linux kernel containing commit restoring the original packed PDU semantics.
How to confirm the fix worked
After patching, repeat the setsockopt sequence on a BT_CONNECTED L2CAP_MODE_EXT_FLOWCTL socket and confirm the transmitted RECONF_REQ body is exactly 6 bytes containing little-endian mtu, mps, and scid values rather than an 8-byte kernel address.
Typical attack path
- Obtain local user access on a Linux system with Bluetooth enabled
- Establish a paired or connectable L2CAP channel using EXT_FLOWCTL mode
- Invoke setsockopt(SOL_BLUETOOTH, BT_RCVMTU, ...) to force reconfiguration
- Capture the resulting L2CAP_ECRED_RECONF_REQ packet from the remote peer
- Extract the leaked kernel stack address from the 8-byte payload for further attacks
How to detect it
Inspect Bluetooth HCI or L2CAP packet captures for RECONF_REQ messages whose length field equals 8 and whose payload bytes vary across connections while containing high-order values consistent with kernel virtual addresses; correlate with setsockopt activity on L2CAP sockets in system call or audit logs.
What your security team should do
- Prioritize kernel updates for all systems exposing Bluetooth L2CAP sockets
- Monitor upstream stable branches for the referenced l2cap_ecred_reconfigure correction
- Limit local Bluetooth socket creation to trusted users via LSM or udev rules until patched
- Review Bluetooth-enabled embedded or IoT deployments for kernel version exposure
The record
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings") converted the on-stack request PDU in l2cap_ecred_reconfigure() from an explicit packed struct to DEFINE_RAW_FLEX(), but did not adjust the size and source-pointer arguments to l2cap_send_cmd(): - struct { - struct l2cap_ecred_reconf_req req; - __le16 scid; - } pdu; + DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1); ... l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ, sizeof(pdu), &pdu); After the conversion, DEFINE_RAW_FLEX() expands to declare an anonymous union pdu_u plus a local pointer "pdu" pointing at it. Therefore: - sizeof(pdu) is now sizeof(struct l2cap_ecred_reconf_req *) = 8 on 64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]). - &pdu is the address of the local pointer's stack storage, not the address of the request payload. l2cap_send_cmd() forwards (data, count) to l2cap_build_cmd(), which calls skb_put_data(skb, data, count). The L2CAP_ECRED_RECONFIGURE_REQ packet body therefore contains 8 bytes copied from the kernel stack starting at &pdu -- the 8 bytes overlap the pdu pointer's value, leaking a kernel stack address to the paired Bluetooth peer. The intended (mtu, mps, scid) fields are not transmitted at all, so the peer rejects the request as malformed and the L2CAP_ECRED_RECONFIGURE feature itself has been broken for the local-side initiator since the introducing commit landed. The sibling site l2cap_ecred_conn_req() in the same commit was converted correctly (sizeof(*pdu) + len, pdu); only this site was missed. Restore the original semantics: pass the full flex-struct size via struct_size(pdu, scid, 1) and the pdu pointer (the struct address) as the source. Validated on a stock 7.0-based host kernel via the real call path: setsockopt(SOL_BLUETOOTH, BT_RCVMTU, ...) on a BT_CONNECTED L2CAP_MODE_EXT_FLOWCTL socket emits an L2CAP_ECRED_RECONFIGURE_REQ whose body is 8 bytes (the on-stack pdu local's value) rather than the expected 6. Three captures from fresh socket / fresh hciemu peer on the same host -- low bytes vary per call, high 0xffff confirms a kernel virtual address (KASLR-randomised stack slot, not a fixed string): RECONF_REQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff After this patch the body is 6 bytes carrying the expected little-endian (mtu, mps, scid).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|