CVE-2026-64127

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer

Commit 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings") converted the on-stack request PDU in l2capecredreconfigure() from an explicit packed struct to DEFINERAWFLEX(), but did not adjust the size and source-pointer arguments to l2capsendcmd():

• struct {
• struct l2capecredreconf_req req;
• __le16 scid;
• } pdu;
• DEFINERAWFLEX(struct l2capecredreconfreq, pdu, scid, 1); ... l2capsendcmd(conn, chan->ident, L2CAPECREDRECONFREQ, sizeof(pdu), &pdu);

After the conversion, DEFINERAWFLEX() expands to declare an anonymous union pdu_u plus a local pointer "pdu" pointing at it. Therefore:

• sizeof(pdu) is now sizeof(struct l2capecredreconf_req *) = 8 on 64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]).
• &pdu is the address of the local pointer's stack storage, not the address of the request payload.

l2capsendcmd() forwards (data, count) to l2capbuildcmd(), which calls skbputdata(skb, data, count). The L2CAPECREDRECONFIGUREREQ packet body therefore contains 8 bytes copied from the kernel stack starting at &pdu -- the 8 bytes overlap the pdu pointer's value, leaking a kernel stack address to the paired Bluetooth peer. The intended (mtu, mps, scid) fields are not transmitted at all, so the peer rejects the request as malformed and the L2CAPECRED_RECONFIGURE feature itself has been broken for the local-side initiator since the introducing commit landed.

The sibling site l2capecredconn_req() in the same commit was converted correctly (sizeof(*pdu) + len, pdu); only this site was missed.

Restore the original semantics: pass the full flex-struct size via struct_size(pdu, scid, 1) and the pdu pointer (the struct address) as the source.

Validated on a stock 7.0-based host kernel via the real call path: setsockopt(SOLBLUETOOTH, BTRCVMTU, ...) on a BTCONNECTED L2CAPMODEEXTFLOWCTL socket emits an L2CAPECREDRECONFIGURE_REQ whose body is 8 bytes (the on-stack pdu local's value) rather than the expected 6. Three captures from fresh socket / fresh hciemu peer on the same host -- low bytes vary per call, high 0xffff confirms a kernel virtual address (KASLR-randomised stack slot, not a fixed string):

RECONFREQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff RECONFREQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff

After this patch the body is 6 bytes carrying the expected little-endian (mtu, mps, scid).