CVE-2026-72333 Linux CVE debrief

Who should care

Linux kernel users, Bluetooth developers, and organizations using Linux-based systems with Bluetooth capabilities should be aware of this vulnerability and take steps to mitigate it. The vulnerability has a significant impact on system security, and affected product deployments should be reviewed for potential exposure. Owners should be assigned for follow-up, and compensating controls should be implemented for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested and closed only after evidence is documented. System administrators and security teams should prioritize patching and mitigation efforts to prevent potential exploitation. Additionally, asset inventory and vulnerability management teams should be informed to ensure that affected systems are properly tracked and prioritized for remediation. Security teams should also review and update their incident response plans to address potential exploitation of this vulnerability. Compensating controls, such as monitoring and detection, should be implemented to detect and respond to potential exploitation attempts. Rollback and change windows should be planned and implemented to ensure that patches are applied in a timely and controlled manner. Source tracking and verification should be performed to ensure that affected systems are properly identified and remediated. Overall, a coordinated and proactive approach is necessary to address this vulnerability and prevent potential exploitation. It is also recommended to verify Linux kernel version and apply latest Bluetooth L2CAP updates, monitor system logs for Bluetooth L2CAP errors, and implement compensating controls for Bluetooth communication. System administrators should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is and

Technical summary

The Linux kernel's Bluetooth L2CAP has a vulnerability where tx idents leak for commands without a response. This causes identifiers to be allocated but never released, potentially leading to exhaustion of the ident range and sending L2CAP_LE_CREDITS packets with an invalid ident of 0. The issue was fixed by releasing idents immediately after sending L2CAP_LE_CREDITS. The vulnerability affects Linux kernel users, Bluetooth developers, and organizations using Linux-based systems with Bluetooth capabilities. The issue has a significant impact on system security and should be addressed promptly.

Defensive priority

Linux kernel users should verify their systems are updated with the latest Bluetooth L2CAP fixes to prevent potential tx ident leaks.

Recommended defensive actions

• Verify Linux kernel version and apply latest Bluetooth L2CAP updates
• Monitor system logs for Bluetooth L2CAP errors
• Implement compensating controls for Bluetooth communication
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE details a tx ident leak in the Linux kernel's Bluetooth L2CAP for commands without a response. Identifiers allocated for such commands are never released, leading to potential exhaustion of the 1-255 ident range. This issue can cause L2CAP_LE_CREDITS packets to be sent with an invalid ident of 0, dropping these commands by remote stacks that validate the ident. The issue was resolved by releasing the ident immediately after sending L2CAP_LE_CREDITS.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.