Answer in brief
CVE-2026-43062 records a High severity (CVSS 7.1) vulnerability in Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=15f02b91056253e8cdc592888f431da0731337b8 <21d3ba696918d6373233aac0b9d51fcabdedddc0 || >=15f02b91056253e8cdc592888f431da0731337b8 <3b94e62caa1dc1198d0d55d97bd710da1dee15d7 || >=15f02b91056253e8cdc592888f431da0731337b8 <111f74547eee8cfedfb854284e80f35c8a491186 || >=15f02b91056253e8cdc592888f431da0731337b8 <dd3b221e21079ade8263fbb7176f3d55ad75d3b6 || >=15f02b91056253e8cdc592888f431da0731337b8 <d90150c72d2e6a8a3079e88755dafcfbe91c746d || >=15f02b91056253e8cdc592888f431da0731337b8 <5a1ea296f8589ce8f1e3141b2b123b34ad010e19 || >=15f02b91056253e8cdc592888f431da0731337b8 <f110b8f58b254bf997cec1bd60701b7798e9bb82 || >=15f02b91056253e8cdc592888f431da0731337b8 <15145675690cab2de1056e7ed68e59cbd0452529 | 21d3ba696918d6373233aac0b9d51fcabdedddc0, 3b94e62caa1dc1198d0d55d97bd710da1dee15d7, 111f74547eee8cfedfb854284e80f35c8a491186, dd3b221e21079ade8263fbb7176f3d55ad75d3b6, d90150c72d2e6a8a3079e88755dafcfbe91c746d, 5a1ea296f8589ce8f1e3141b2b123b34ad010e19, f110b8f58b254bf997cec1bd60701b7798e9bb82, 15145675690cab2de1056e7ed68e59cbd0452529 |
| Linux/Linuxgeneric | 5.7 | Not reported |
Published upstream
May 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 16, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() l2cap_ecred_reconf_rsp() casts the incoming data to struct l2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes with result at offset 0). This causes two problems: - The sizeof(*rsp) length check requires 8 bytes instead of the correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected with -EPROTO. - rsp->result reads from offset 6 instead of offset 0, returning wrong data when the packet is large enough to pass the check. Fix by using the correct type. Also pass the already byte-swapped result variable to BT_DBG instead of the raw __le16 field.
Quoted source text, attributed separately from HOL analysis.