PT-2026-34404 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-05-14 · CVE-2026-31499

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A deadlock can occur in the Bluetooth L2CAP component within the l2cap conn del() function. This happens because l2cap conn del() calls cancel delayed work sync() for both info timer and id addr timer while holding the conn->lock. Since the work functions l2cap info timeout() and l2cap conn update id addr() also attempt to acquire conn->lock, an AB-BA deadlock may occur if the work is already executing when the lock is taken.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2026-31499

Affected Products

Linux Kernel

References · 15

• https://git.kernel.org/stable/c/d008460de352e534f6721de829b093368564ec66 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31499 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31499 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31499 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-31499 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31499 · Vendor Advisory
• https://git.kernel.org/stable/c/3f26ecbd9cde621dd94be7ef252c7210b965a5c7 · Patch
• https://ubuntu.com/security/CVE-2026-31499 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31499 · Vendor Advisory
• https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608 · Patch
• https://twitter.com/CVEnew/status/2046979977799684585 · Twitter Post
• https://t.me/cveNotify/163465 · Telegram Post
• https://git.kernel.org/stable/c/f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-31499 · Note
• https://git.kernel.org/linus/00fdebbbc557a2fc21321ff2eaa22fd70c078608 · Note