SB2026072097 - Information disclosure in Linux kernel bluetooth

Description

This security bulletin contains information about 1 vulnerability.

1) Information disclosure (CVE-ID: CVE-2026-64127)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an information leak caused by incorrect size and source-pointer arguments in l2cap_ecred_reconfigure() in the Bluetooth L2CAP subsystem when sending an L2CAP_ECRED_RECONFIGURE_REQ packet to a paired Bluetooth peer. A remote attacker can trigger ecred reconfiguration handling to disclose sensitive information.

The malformed packet copies bytes from kernel stack memory and can expose a kernel stack address to the peer. Exploitation requires Bluetooth connectivity with a paired peer.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/051922ab709c0a6917eae765c22481dfc68379e5
• https://git.kernel.org/stable/c/3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d
• https://git.kernel.org/stable/c/356c9d1a1cbacd2a1640fff3c050e1c3472e924f
• https://git.kernel.org/stable/c/ed5fcd2a26f0c16fc289c8cd6b03328a0582a687