Linux Kernel CVE-2026-63976

Exploitation requires the attacker to be an in-range Bluetooth L2CAP peer that has already established and successfully reconfigured an Enhanced Credit Based (ECRED) connection-oriented channel with the target - the stale chan->ident left by l2cap_ecred_reconf_rsp() is the exact precondition, and the trigger is a replayed ECRED reconfigure FAILURE response reusing that ident. Limiting factors: the CVSS vector is AV:A (Bluetooth adjacent radio range only, not internet-remote), the attacker must be an accepted/connected peer rather than a fully unauthenticated stranger to the stack, the target must have Bluetooth LE with ECRED channels active, and the affected code path exists only in kernels from ~5.7 up to the fixed stable versions. Although PR:N per the vector means no OS-level credentials are needed, the practical requirement of an active reconfigured L2CAP session substantially narrows who can trigger it.

Signals are mixed and worth reconciling. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8) rates full confidentiality/integrity/availability loss, but the described concrete impact is destruction of an already-established channel (l2cap_chan_del with ECONNRESET) - that is a denial-of-service/session-teardown outcome, not demonstrated data theft or code execution. The C:H/I:H claim most plausibly reflects the latent use-after-free the patch hardens against (which could escalate to memory corruption) rather than the replay itself; the vendor tag 'Information Disclosure' is inconsistent with the description and should be treated skeptically. AV:A is the key limiter: the attacker must be within Bluetooth radio range and must already be the L2CAP peer that completed a reconfiguration, so this is not internet-remote. EPSS is low (0.31%, 23rd percentile), there is no CISA KEV listing and no SSVC decision data, aligning with a real-but-not-urgent, proximity-bound issue. Net: a legitimate memory-safety/DoS bug worth patching in the normal cycle, not an emergency for most fleets - the headline 8.8 overstates realistic exposure given the adjacent-only vector and DoS-centric described impact.

An attacker within Bluetooth range establishes an LE connection-oriented (ECRED) channel with a target Linux host and drives it through a successful reconfiguration, after which the kernel leaves the channel's stale ident set. The attacker then sends a spoofed/replayed ECRED reconfigure failure response carrying that recycled ident, and the kernel matches it and tears down the live channel via l2cap_chan_del(..., ECONNRESET); the same stale-reference path is what the fix hardens against a use-after-free. No public POC is identified at time of analysis, and the adjacent-network, low-complexity vector means exploitation is feasible for a proximate peer but not remotely at scale.