CVE-2026-43062: falha de alta gravidade em Linux
Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.2%
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
l2cap_ecred_reconf_rsp() casts the incoming data to struct
l2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with
result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes
with result at offset 0).
This causes two problems:
- The sizeof(*rsp) length check requires 8 bytes instead of the
correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected
with -EPROTO.
- rsp->result reads from offset 6 instead of offset 0, returning
wrong data when the packet is large enough to pass the check.
Fix by using the correct type. Also pass the already byte-swapped
result variable to BT_DBG instead of the raw __le16 field.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Produtos afetados
Linux · LinuxCVEs relacionadas — Linux
No mesmo produto, das mais perigosas para as menos.
CVE-2026-31431HIGHcrypto: algif_aead - Revert to operating out-of-placeEPSS 98.1%KEVCVE-2026-46300HIGHnet: skbuff: preserve shared-frag marker during coalescingEPSS 16.1%KEVCVE-2024-53197HIGHALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devicesEPSS 4.1%KEVCVE-2024-53104HIGHmedia: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_formatEPSS 3.4%KEVCVE-2025-39682CRITICALtls: fix handling of zero-length records on the rx_listEPSS 3.2%KEVCVE-2024-36971HIGHnet: fix __dst_negative_advice() raceEPSS 2.7%KEV
Referências
https://git.kernel.org/stable/c/111f74547eee8cfedfb854284e80f35c8a491186https://git.kernel.org/stable/c/15145675690cab2de1056e7ed68e59cbd0452529https://git.kernel.org/stable/c/21d3ba696918d6373233aac0b9d51fcabdedddc0https://git.kernel.org/stable/c/3b94e62caa1dc1198d0d55d97bd710da1dee15d7https://git.kernel.org/stable/c/5a1ea296f8589ce8f1e3141b2b123b34ad010e19https://git.kernel.org/stable/c/d90150c72d2e6a8a3079e88755dafcfbe91c746dhttps://git.kernel.org/stable/c/dd3b221e21079ade8263fbb7176f3d55ad75d3b6https://git.kernel.org/stable/c/f110b8f58b254bf997cec1bd60701b7798e9bb82