PT-2026-51965 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-53071

Mitre

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: l2cap: Add missing chan lock in l2cap ecred reconf rsp

l2cap ecred reconf rsp() calls l2cap chan del() without holding l2cap chan lock(). Every other l2cap chan del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it.

Add l2cap chan hold() and l2cap chan lock() before l2cap chan del(), and l2cap chan unlock() and l2cap chan put() after, matching the pattern used in l2cap ecred conn rsp() and l2cap conn del().

Related Identifiers

CVE-2026-53071

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53071 · Security Note
• https://git.kernel.org/stable/c/77a853aec710b2fdf41fa298ea3cbc9a4358f917 · Note
• https://git.kernel.org/stable/c/fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14 · Note
• https://git.kernel.org/stable/c/96dca51715d86559ed6ed8028e5445cecb80f3ae · Note
• https://git.kernel.org/stable/c/42776497cdbc9a665b384a6dcb85f0d4bd927eab · Note
• https://git.kernel.org/stable/c/dc89961b76f12aff47124c1df4bdb32a080f4d0c · Note
• https://git.kernel.org/stable/c/330b20ec97916961ee0e6c29c06bc0fa7c96e64c · Note
• https://git.kernel.org/stable/c/0ccd75c51f620374086f359e906917676e699a1c · Note
• https://git.kernel.org/stable/c/5501d055a1ce3c747141e3955ba8cf034d193f3e · Note