CVE-2026-53071 Details
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
A vulnerability in the Linux kernel's Bluetooth implementation, specifically within the L2CAP (Logical Link Control and Adaptation Protocol) layer, has been addressed. The issue arose because the function 'l2cap_ecred_reconf_rsp()' called 'l2cap_chan_del()' without first acquiring the necessary channel lock. This omission allowed a remote Bluetooth Low Energy (BLE) device to send a manipulated L2CAP ECRED reconfiguration response, potentially corrupting the channel list while it was being processed by another thread. The vulnerability has been fixed by ensuring that the channel is properly locked and held before deletion, and released afterward, aligning with the established protocol for similar functions.
Users can upgrade to the patched version of the Linux kernel available in the Linux Kernel Git Repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-667 | Improper Locking | [email protected] |
| CWE-416 | Use After Free | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.7, < 5.10.258 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.141 >= 6.7, < 6.12.91 >= 6.13, < 6.18.33 >= 6.19, < 7.0.10 |
CPE
Remediation
| |
Change History
12 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | redhat-SADP |
| Sep 9, 2026 | CVE Modified | redhat-SADP |
| Sep 9, 2026 | CVE Modified | kernel.org |
| Jul 23, 2026 | CVE Modified | redhat-SADP |
| Jul 22, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 8, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 28, 2026 | CVE Modified | kernel.org |
| Jun 24, 2026 | New CVE Received | kernel.org |