An integer underflow error within the "l2cap_config_req()" function in net/bluetooth/l2cap_core.c when handling a l2cap configuration request can be exploited to cause a buffer overflow.