Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-53071

Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 15f02b91056253e8cdc592888f431da0731337b8 to < 96dca51715d86559ed6ed8028e5445cecb80f3aeaffected
  • 15f02b91056253e8cdc592888f431da0731337b8 to < 330b20ec97916961ee0e6c29c06bc0fa7c96e64caffected
  • 15f02b91056253e8cdc592888f431da0731337b8 to < 0ccd75c51f620374086f359e906917676e699a1caffected
  • 15f02b91056253e8cdc592888f431da0731337b8 to < 77a853aec710b2fdf41fa298ea3cbc9a4358f917affected
  • 15f02b91056253e8cdc592888f431da0731337b8 to < fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14affected
  • 15f02b91056253e8cdc592888f431da0731337b8 to < dc89961b76f12aff47124c1df4bdb32a080f4d0caffected
  • 15f02b91056253e8cdc592888f431da0731337b8 to < 5501d055a1ce3c747141e3955ba8cf034d193f3eaffected
  • 15f02b91056253e8cdc592888f431da0731337b8 to < 42776497cdbc9a665b384a6dcb85f0d4bd927eabaffected

Linux Linux

Default version status: affected

  • 5.7affected
  • 0 to < 5.7unaffected
  • 5.10.258 to ≤ 5.10.*unaffected
  • 5.15.209 to ≤ 5.15.*unaffected
  • 6.1.175 to ≤ 6.1.*unaffected
  • 6.6.141 to ≤ 6.6.*unaffected
  • 6.12.91 to ≤ 6.12.*unaffected
  • 6.18.33 to ≤ 6.18.*unaffected
  • 7.0.10 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References