CVE-2026-43062

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-43062

Key Details

CVE	CVE-2026-43062
CVSS Score / Version	7.1 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L`
CVSS Prose	attack vector is adjacent; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is high; availability impact is low.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()

l2cap_ecred_reconf_rsp() casts the incoming data to struct

l2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with

result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes

with result at offset 0).

This causes two problems:

- The sizeof(*rsp) length check requires 8 bytes instead of the

correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected

with -EPROTO.

- rsp->result reads from offset 6 instead of offset 0, returning

wrong data when the packet is large enough to pass the check.

Fix by using the correct type. Also pass the already byte-swapped

result variable to BT_DBG instead of the raw __le16 field. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-43062
CVE	https://www.cve.org/CVERecord?id=CVE-2026-43062

Source

Reference

NVD

CVE