CVE-2026-23395

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ

Currently the code attempts to accept requests regardless of the command identifier which may cause multiple requests to be marked as pending (FLAG_DEFER_SETUP) which can cause more than L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer causing an overflow.

The spec is quite clear that the same identifier shall not be used on subsequent requests:

'Within each signaling channel a different Identifier shall be used for each successive request or indication.' https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d

So this attempts to check if there are any channels pending with the same identifier and rejects if any are found.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Mar 25, 2026
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-233965.5In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL deref in mesh_matches_local() mesh_matches_loCVE-2026-233977.1In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnlCVE-2026-233985.5In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_vCVE-2026-233995.5In the Linux kernel, the following vulnerability has been resolved: nf_tables: nft_dynset: fix possible stateful expression memleak in erroCVE-2026-23406.5A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modifiCVE-2026-234005.5In the Linux kernel, the following vulnerability has been resolved: rust_binder: call set_notification_done() without proc lock Consider tCVE-2026-234015.5In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIOCVE-2026-234025.5In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present CVE-2026-234035.5In the Linux kernel, the following vulnerability has been resolved: apparmor: fix memory leak in verify_header The function sets `*ns = NUCVE-2026-234045.5In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach ThCVE-2026-234055.5In the Linux kernel, the following vulnerability has been resolved: apparmor: fix: limit the number of levels of policy namespaces CurrentCVE-2026-234067.8In the Linux kernel, the following vulnerability has been resolved: apparmor: fix side-effect bug in match_char() macro usage The match_ch
CVE-2026-23395: High severity, CVSS 8.8 | Vulnix