Vulnerability in Linux

[ Description ]Official description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan l2cap_new_connection() sets default value of channel mode to match the parent channel. l2cap_le_connect_req() left this at the default, and created L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that mode. This causes FLAG_DEFER_SETUP channels to reply to L2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect. It can also result to stack OOB write (of l2cap_alloc_cid determined values) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not limit maximum number of deferred channels or check for duplicate ident. Fix by setting chan->mode correctly in l2cap_le_connect_req(). Also check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE instead of OOB write to make it less brittle.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR9 Oct 2026CERTFR-2026-AVI-1289

  Multiple vulnerabilities in the Debian LTS Linux kernel Translated from French

  Multiple vulnerabilities have been discovered in the Debian LTS Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and denial of service.

  CVE-2025-38237CVE-2025-39833CVE-2025-39925+1311 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1253

  Multiple vulnerabilities in the Debian Linux kernel Translated from French

  Multiple vulnerabilities have been discovered in the Debian Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and denial of service.

  CVE-2025-38237CVE-2025-39833CVE-2025-39925+1310 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3579

  Linux Kernel: Multiple vulnerabilities Translated from German

  CVE-2026-97615CVE-2026-97978CVE-2026-98127+590 more CVEs

[ References ]References

• git.kernel.org/stable/c/0e1fc7cab95ad958e55d70a5dfaaea687c9c639f
• git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10
• git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0
• git.kernel.org/stable/c/564ae0e05e598aa895b9dbd18cb7d6eb64752869
• git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1
• git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80
• git.kernel.org/stable/c/aab17938998b29e75c3324763411aef3e300fc67
• git.kernel.org/stable/c/ad0f44a3f1f688558ed876a0702bc2c82b0df689