CVE-2026-43062

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()<br /> <br /> l2cap_ecred_reconf_rsp() casts the incoming data to struct<br /> l2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with<br /> result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes<br /> with result at offset 0).<br /> <br /> This causes two problems:<br /> <br /> - The sizeof(*rsp) length check requires 8 bytes instead of the<br /> correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected<br /> with -EPROTO.<br /> <br /> - rsp-&gt;result reads from offset 6 instead of offset 0, returning<br /> wrong data when the packet is large enough to pass the check.<br /> <br /> Fix by using the correct type. Also pass the already byte-swapped<br /> result variable to BT_DBG instead of the raw __le16 field.