CVE-2026-72333

A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation. A remote attacker, by continuously streaming data to a host, can trigger an identifier (ident) leak. This occurs because identifiers for certain commands, such as L2CAP_LE_CREDITS, are not properly released. This exhaustion of available identifiers leads to subsequent packets being sent with an invalid identifier, causing remote Bluetooth stacks to drop these commands and permanently stall the communication channel, resulting in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.