Linux Kernel Bluetooth L2CAP Channel Disconnection Vulnerability

A vulnerability in the Linux kernel's Bluetooth implementation can lead to a crash when handling Enhanced Credit Based Connection Response packets. This issue arises in the L2CAP (Logical Link Control and Adaptation Protocol) layer, specifically when a destination CID (Channel Identifier) is received for an already-assigned channel. The Bluetooth specification requires both channels to be discarded, but the current implementation can invalidate the iteration cursor used to manage the channels, leading to a potential crash. The problem occurs in several versions of the Linux kernel.

Impact

The vulnerability can cause a crash in the Bluetooth L2CAP layer, disrupting active connections and potentially leading to a denial of service.

Reproduction

The vulnerability can be reproduced by sending an Enhanced Credit Based Connection Response packet with a destination CID that is already assigned to another channel. This will trigger the incorrect channel management procedure, causing a crash.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for updating the kernel can be found in the official Linux kernel documentation.