Skip to content
fr Sign in
8.8 High

CVE-2026-53071 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in…

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().

Affected products and versions

Product Affected versions Fixed in
Linux 7.1 earliest → < 7.1 7.1
Linux 7.0 earliest → < 7.0.10 7.0.10
Linux 6.18 earliest → < 6.18.33 6.18.33
Linux 6.12 earliest → < 6.12.91 6.12.91
Linux 6.6 earliest → < 6.6.141 6.6.141
Linux 6.1 earliest → < 6.1.175 6.1.175
Linux 5.15 earliest → < 5.15.209 5.15.209
Linux 5.10 earliest → < 5.10.258 5.10.258
Linux 5.7 No fix stated
Show the 9 other branches
Product Affected versions Fixed in
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux 6 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Versions not published
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Versions not published
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Versions not published
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Linux

The 18283 CVEs of Linux →
CVE-2026-99270 In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler() 8.1 High CVE-2026-99269 In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before… 7.8 High CVE-2026-99261 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for… Not rated CVE-2026-99260 In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfs_new_attr_flags… Not rated
Track this CVE