Answer in brief
CVE-2026-63976 records a Unknown severity vulnerability in Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-63976 records a Unknown severity vulnerability in Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=15f02b91056253e8cdc592888f431da0731337b8 <59f5ecf6ad5c4db6ae81965a96156954a3b0d89a || >=15f02b91056253e8cdc592888f431da0731337b8 <ae0152d77d101c920769934fb102b18de0c6f526 || >=15f02b91056253e8cdc592888f431da0731337b8 <c2afd2613fda90107c5e2fe8e855627451749c78 || >=15f02b91056253e8cdc592888f431da0731337b8 <cc2b4f749de09975bfa06e58bbbad2f6acd4c79c || >=15f02b91056253e8cdc592888f431da0731337b8 <3b5b5f423b4fd23404a393bda8adba3cd6f74ef1 || >=15f02b91056253e8cdc592888f431da0731337b8 <f39049304ba655ffcbb92edbdf8c51a1f1210bed || >=15f02b91056253e8cdc592888f431da0731337b8 <8e7977afaef37c6bd2b2654f1bce6ab40d471147 || >=15f02b91056253e8cdc592888f431da0731337b8 <00e1950716c6ed67d74777b2db286b0fa23b4be9 | 59f5ecf6ad5c4db6ae81965a96156954a3b0d89a, ae0152d77d101c920769934fb102b18de0c6f526, c2afd2613fda90107c5e2fe8e855627451749c78, cc2b4f749de09975bfa06e58bbbad2f6acd4c79c, 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1, f39049304ba655ffcbb92edbdf8c51a1f1210bed, 8e7977afaef37c6bd2b2654f1bce6ab40d471147, 00e1950716c6ed67d74777b2db286b0fa23b4be9 |
| Linux/Linuxgeneric | 5.7 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value. A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET). Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=15f02b91056253e8cdc592888f431da0731337b8 <59f5ecf6ad5c4db6ae81965a96156954a3b0d89a || >=15f02b91056253e8cdc592888f431da0731337b8 <ae0152d77d101c920769934fb102b18de0c6f526 || >=15f02b91056253e8cdc592888f431da0731337b8 <c2afd2613fda90107c5e2fe8e855627451749c78 || >=15f02b91056253e8cdc592888f431da0731337b8 <cc2b4f749de09975bfa06e58bbbad2f6acd4c79c || >=15f02b91056253e8cdc592888f431da0731337b8 <3b5b5f423b4fd23404a393bda8adba3cd6f74ef1 || >=15f02b91056253e8cdc592888f431da0731337b8 <f39049304ba655ffcbb92edbdf8c51a1f1210bed || >=15f02b91056253e8cdc592888f431da0731337b8 <8e7977afaef37c6bd2b2654f1bce6ab40d471147 || >=15f02b91056253e8cdc592888f431da0731337b8 <00e1950716c6ed67d74777b2db286b0fa23b4be9 | 59f5ecf6ad5c4db6ae81965a96156954a3b0d89a, ae0152d77d101c920769934fb102b18de0c6f526, c2afd2613fda90107c5e2fe8e855627451749c78, cc2b4f749de09975bfa06e58bbbad2f6acd4c79c, 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1, f39049304ba655ffcbb92edbdf8c51a1f1210bed, 8e7977afaef37c6bd2b2654f1bce6ab40d471147, 00e1950716c6ed67d74777b2db286b0fa23b4be9 |
| Linux/Linuxgeneric | 5.7 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value. A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET). Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).
Quoted source text, attributed separately from HOL analysis.