CVE-2026-63976 (CVSS 8.8)

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value. A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET). Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).

Is your site exposed to CVE-2026-63976?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0045

Probability of exploitation

0.36%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9 https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1 https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147 https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526 https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78 https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed

Frequently Asked Questions

What is CVE-2026-63976? +

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value. A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET). Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident). It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2026-63976? +

CVE-2026-63976 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0045, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-63976? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-63976