CyberSecBulletin
CVE-2026-63976NVD status: Analyzed

Linux: Use of Multiple Resources with Duplicate Identifier

Published Updated By the CyberSecBulletin desk

CVE-2026-63976 is a high-severity use of multiple resources with duplicate identifier vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 59f5ecf6ad5c4db6ae81965a96156954a3b0d89a, ae0152d77d101c920769934fb102b18de0c6f526, c2afd2613fda90107c5e2fe8e855627451749c78 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.57% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 59f5ecf6ad5c4db6ae81965a96156954a3b0d89a or ae0152d77d101c920769934fb102b18de0c6f526 or c2afd2613fda90107c5e2fe8e855627451749c78 or cc2b4f749de09975bfa06e58bbbad2f6acd4c79c, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux15f02b91056253e8cdc592888f431da0731337b8 up to, but not including, 59f5ecf6ad5c4db6ae81965a96156954a3b0d89a; 15f02b91056253e8cdc592888f431da0731337b8 up to, but not including, ae0152d77d101c920769934fb102b18de0c6f526; 15f02b91056253e8cdc592888f431da0731337b8 up to, but not including, c2afd2613fda90107c5e2fe8e855627451749c78; 15f02b91056253e8cdc592888f431da0731337b8 up to, but not including, cc2b4f749de09975bfa06e58bbbad2f6acd4c79c; 15f02b91056253e8cdc592888f431da0731337b8 up to, but not including, 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1; 15f02b91056253e8cdc592888f431da0731337b8 up to, but not including, f39049304ba655ffcbb92edbdf8c51a1f1210bed; 15f02b91056253e8cdc592888f431da0731337b8 up to, but not including, 8e7977afaef37c6bd2b2654f1bce6ab40d471147; 15f02b91056253e8cdc592888f431da0731337b8 up to, but not including, 00e1950716c6ed67d74777b2db286b0fa23b4be9; and 1 more ranges59f5ecf6ad5c4db6ae81965a96156954a3b0d89a, ae0152d77d101c920769934fb102b18de0c6f526, c2afd2613fda90107c5e2fe8e855627451749c78, cc2b4f749de09975bfa06e58bbbad2f6acd4c79c, 3b5b5f423b4fd23404a393bda8adba3cd6f74ef1, f39049304ba655ffcbb92edbdf8c51a1f1210bed
LinuxLinux Kernel5.7 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.93; 6.13 up to, but not including, 6.18.35; 6.19 up to, but not including, 7.0.12; 7.15.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value. A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET). Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Multiple Resources with Duplicate Identifier

The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

How developers prevent this class of flaw

  • Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.

More Use of Multiple Resources with Duplicate Identifier vulnerabilities (CWE-694)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use of Multiple Resources with Duplicate Identifier vulnerabilities

Spotted an error? Tell us.