Linux Kernel EUVD-2026-86939

Exploitation requires the target host to run a userspace application that creates an L2CAP LE listening channel (parent channel) in L2CAP_MODE_EXT_FLOWCTL with FLAG_DEFER_SETUP enabled - this specific, non-default socket configuration is what causes l2cap_le_connect_req() to spawn EXT_FLOWCTL child channels and reach the vulnerable l2cap_ecred_rsp_defer() path. The attacker must be within Bluetooth LE radio range (adjacent, AV:A) and send multiple/duplicate-ident L2CAP_LE_CONN_REQ frames to exceed the unchecked deferred-channel count. Limiting factors: physical Bluetooth proximity, dependence on a victim app using EXT_FLOWCTL + deferred setup (most Bluetooth stacks do not), affected kernels 5.7 through the fixed stable releases, and no user interaction on the attacker side beyond radio-range access.

This is a genuine stack out-of-bounds write in the Linux kernel Bluetooth L2CAP LE path, but the real-world priority is moderate, not the 7.5 the CVSS implies. The supplied vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H rates all three impacts High, yet the description shows the OOB write is of l2cap_alloc_cid-determined CID values (not attacker-controlled arbitrary data), and the maintainer fix simply replaces the write with WARN_ON_ONCE - consistent with a crash/corruption (availability) outcome rather than a confidentiality leak. The 'Information Disclosure' tag therefore conflicts with the actual defect (an OOB WRITE / CWE-787), and the C:H claim is not well supported. AC:H is credible: exploitation needs a victim application that opens an L2CAP LE listening socket in L2CAP_MODE_EXT_FLOWCTL with FLAG_DEFER_SETUP, plus a burst of connection requests (no deferred-channel cap and no duplicate-ident check) to overflow the array - a non-default, application-specific condition. There is no EPSS score, no CISA KEV listing, and no public exploit referenced, so exploitation status is: no public exploit identified at time of analysis. Net: a real but conditional adjacent-radius memory-safety bug, best treated as a DoS/corruption issue and patched on normal kernel cadence rather than as an emergency.

A victim device runs a Bluetooth LE application that listens on an L2CAP channel configured for EXT_FLOWCTL with deferred setup. An attacker within Bluetooth radio range sends a stream of crafted L2CAP_LE_CONN_REQ frames (with no duplicate-ident check and no channel cap enforced), driving l2cap_ecred_rsp_defer() to write CID values past a fixed stack array, corrupting the kernel stack and crashing the host. No public exploit code is identified at time of analysis.