CVE-2026-64127

A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component. A paired Bluetooth device could exploit this vulnerability by sending a specially crafted reconfiguration request. This would cause the kernel to inadvertently disclose a portion of its internal memory, specifically a kernel stack address, to the peer. This information disclosure could potentially be used to bypass security protections.

This vulnerability is rated as Moderate severity because exploitation requires an established connection with an adjacent paired Bluetooth device, and the impact is confined to disclosing a kernel stack address rather than allowing remote code execution. Typical Red Hat Enterprise Linux server deployments do not include Bluetooth hardware, and the Bluetooth service is inactive or absent by default. Consequently, exposure is limited to systems operating in proximity to untrusted devices with active Bluetooth connections.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.