CVE-2026-63976

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: l2cap: clear chan-&gt;ident on ECRED reconfiguration success<br /> <br /> l2cap_ecred_reconf_rsp() returns early on success without clearing<br /> chan-&gt;ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp,<br /> l2cap_le_connect_rsp, l2cap_config_rsp) clears chan-&gt;ident after a<br /> successful transaction to prevent the channel from matching subsequent<br /> responses with the recycled ident value.<br /> <br /> A remote attacker that completed a reconfiguration as the peer can<br /> replay a failure response with the stale ident, causing the kernel to<br /> match and destroy the already-established channel via<br /> l2cap_chan_del(chan, ECONNRESET).<br /> <br /> Clear chan-&gt;ident for all matching channels on success, and harden the<br /> failure path by using l2cap_chan_hold_unless_zero() consistent with<br /> other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).