High 8.8Published Mar 25, 2026

CVE-2026-23395Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ

Updated under an hour ago (Oct 28, 2026, 8:00 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Currently the code attempts to accept requests regardless of the command identifier which may cause multiple requests to be marked as pending (FLAG_DEFER_SETUP) which can cause more than L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer causing an overflow. The spec is quite clear that the same identifier shall not be used on subsequent requests: 'Within each signaling channel a different Identifier shall be used for each successive request or indication.' https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d So this attempts to check if there are any channels pending with the same identifier and rejects if any are found.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-20
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	15f02b91056253e8cdc592888f431da0731337b8 builds before 10a7a702542240d5edb2b39450ac951c59ccd009; from 15f02b91056253e8cdc592888f431da0731337b8 before 46e5b71666fb7652082e4e214a3365f4b14f1dc3; from 15f02b91056253e8cdc592888f431da0731337b8 before fb4a3a26483f3ea2cd21c7a2f7c45d5670600465; from 15f02b91056253e8cdc592888f431da0731337b8 before 2124d82fd25e1671bb3ceb37998af5aae5903e06; 15f02b91056253e8cdc592888f431da0731337b8 builds before 6b949a6b33cbdf621d9fc6f0c48ac00915dbf514; 15f02b91056253e8cdc592888f431da0731337b8 builds before 8d0d94f8ba5b3a0beec3b0da558b9bea48018117; from 15f02b91056253e8cdc592888f431da0731337b8 before e72ee455297b794b852e5cea8d2d7bb17312172a; 15f02b91056253e8cdc592888f431da0731337b8 builds before 5b3e2052334f2ff6d5200e952f4aa66994d09899	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.7.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 5.7; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/10a7a702542240d5edb2b39450ac951c59ccd009	patch
https://git.kernel.org/stable/c/46e5b71666fb7652082e4e214a3365f4b14f1dc3	patch
https://git.kernel.org/stable/c/fb4a3a26483f3ea2cd21c7a2f7c45d5670600465	patch
https://git.kernel.org/stable/c/2124d82fd25e1671bb3ceb37998af5aae5903e06	patch
https://git.kernel.org/stable/c/6b949a6b33cbdf621d9fc6f0c48ac00915dbf514	patch
https://git.kernel.org/stable/c/8d0d94f8ba5b3a0beec3b0da558b9bea48018117	patch
https://git.kernel.org/stable/c/e72ee455297b794b852e5cea8d2d7bb17312172a	patch
https://git.kernel.org/stable/c/5b3e2052334f2ff6d5200e952f4aa66994d09899	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.