Linux Kernel EUVD-2026-27694

The vulnerability exists in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) subsystem, specifically in the handler for L2CAP_LE_CONN_REQ (LE Credit Flow Control connection requests). L2CAP is a key protocol in the Bluetooth stack that provides connection-oriented and connectionless data services with protocol multiplexing, segmentation, and reassembly. LE Credit Flow Control (CFC) is a Bluetooth Low Energy mechanism that manages data flow between devices. The flaw stems from a missing validation check for encryption key size during the connection establishment phase. According to Bluetooth Core Specification test case L2CAP/LE/CFC/BV-15-C, implementations must verify encryption key size meets minimum requirements and reject connections with L2CAP_CR_LE_BAD_KEY_SIZE error code when keys are too short. Without this check, the kernel accepts connections encrypted with weak keys, violating Bluetooth Security Mode requirements. The affected code path handles incoming connection requests on Bluetooth LE links, where proper key validation is critical for maintaining confidentiality guarantees. The fix introduced in commits starting from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d adds explicit key size verification before accepting LE connection requests.