CVE-2026-64127 Linux CVE debrief

Who should care

Linux kernel users, Bluetooth developers, and security teams should be aware of this vulnerability. The vulnerability could potentially allow an attacker to leak kernel stack addresses, leading to potential privilege escalation or information disclosure.

Technical summary

The vulnerability is caused by a change in the l2cap_ecred_reconfigure() function, where the size and source-pointer arguments to l2cap_send_cmd() were not adjusted after converting the on-stack request PDU to a packed struct. This results in the transmission of incorrect data, leading to a leak of kernel stack addresses. The issue arises from a commit that converted an on-stack request PDU to a packed struct, but did not adjust the size and source-pointer arguments to l2cap_send_cmd(). This leads to the transmission of 8 bytes from the kernel stack, leaking a kernel stack address to the paired Bluetooth peer. The intended fields are not transmitted, causing the peer to reject the request as malformed. The L2CAP_ECRED_RECONFIGURE feature is broken for the local-side initiator since the introducing commit landed. Linux kernel users should be aware of this vulnerability and consider updating to the latest kernel version or applying the patch to mitigate the issue.

Defensive priority

High

Recommended defensive actions

• Apply the patch to restore the original semantics: pass the full flex-struct size via struct_size(pdu, scid, 1) and the pdu pointer (the struct address) as the source.
• Update the Linux kernel to the latest version.
• Monitor Bluetooth traffic for suspicious activity.
• Implement additional security measures, such as address space layout randomization (ASLR) and data execution prevention (DEP).
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was discovered through code analysis and validated on a stock 7.0-based host kernel via the real call path. The issue is caused by a commit that converted an on-stack request PDU to a packed struct, but did not adjust the size and source-pointer arguments to l2cap_send_cmd().

Official resources