An issue was discovered in the Linux kernel through 6.0.10. l2capconfigreq in net/bluetooth/l2capcore.c has an integer wraparound via L2CAPCONF_REQ packets.
{ "urgency": "not yet assigned" }