PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43062 Linux CVE debrief

A type confusion vulnerability in the Linux kernel's Bluetooth L2CAP subsystem causes incorrect handling of Enhanced Credit-Based Flow Control (ECRED) reconfiguration response packets. The `l2cap_ecred_reconf_rsp()` function incorrectly casts incoming data to `struct l2cap_ecred_conn_rsp` (8 bytes) instead of `struct l2cap_ecred_reconf_rsp` (2 bytes). This results in two defects: valid reconfiguration responses are rejected with `-EPROTO` due to an oversized length check requiring 8 bytes rather than 2, and when packets are large enough to pass the check, the result code is read from offset 6 instead of offset 0, yielding incorrect data. The vulnerability affects multiple Linux kernel versions from 5.7 through 7.0-rc4. Patches are available from the stable kernel tree. No known exploitation in the wild has been reported, and this vulnerability is not listed in CISA KEV.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-05
Original CVE updated
2026-05-29
Advisory published
2026-05-05
Advisory updated
2026-05-29

Who should care

Organizations running Linux systems with Bluetooth capabilities, particularly those using Enhanced Credit-Based Flow Control for L2CAP channels in industrial, medical, or enterprise environments where Bluetooth connectivity is required for adjacent-network device communication.

Technical summary

The vulnerability exists in `l2cap_ecred_reconf_rsp()` in the Linux kernel's Bluetooth L2CAP implementation. The function incorrectly uses `struct l2cap_ecred_conn_rsp` (8 bytes, result at offset 6) instead of `struct l2cap_ecred_reconf_rsp` (2 bytes, result at offset 0). This type confusion causes: (1) rejection of valid 2-byte `L2CAP_ECRED_RECONF_RSP` packets due to `sizeof(*rsp)` requiring 8 bytes, returning `-EPROTO`; and (2) incorrect result parsing at offset 6 when packets exceed the erroneous length threshold. The fix uses the correct struct type and passes the byte-swapped result to `BT_DBG`. Affected versions span 5.7 through 5.10.252, 5.11 through 5.15.202, 5.16 through 6.1.166, 6.2 through 6.6.129, 6.7 through 6.12.77, 6.13 through 6.18.19, 6.19 through 6.19.9, and 7.0-rc1 through 7.0-rc4.

Defensive priority

high

Recommended defensive actions

  • Apply stable kernel patches for affected versions as listed in vendor references
  • Prioritize patching systems with active Bluetooth interfaces in adjacent network scenarios
  • Monitor kernel changelogs for backported fixes if running distribution-customized kernels
  • Validate Bluetooth L2CAP ECRED functionality after patching to ensure reconfiguration responses process correctly

Evidence notes

CVE description confirms type confusion with incorrect struct cast in l2cap_ecred_reconf_rsp(). NVD CPE criteria specify affected kernel version ranges. Eight patch commits are referenced from git.kernel.org stable tree. CVSS 3.1 vector AV:A indicates adjacent network attack vector, consistent with Bluetooth proximity requirements.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43062 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43062

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43062 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43062

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/111f74547eee8cfedfb854284e80f35c8a491186

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/15145675690cab2de1056e7ed68e59cbd0452529

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/21d3ba696918d6373233aac0b9d51fcabdedddc0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3b94e62caa1dc1198d0d55d97bd710da1dee15d7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5a1ea296f8589ce8f1e3141b2b123b34ad010e19

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d90150c72d2e6a8a3079e88755dafcfbe91c746d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/dd3b221e21079ade8263fbb7176f3d55ad75d3b6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.