Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-24T00:00:00 kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-416

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. A remote Bluetooth Low Energy (BLE) device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list, potentially causing a Denial of Service (DoS) by making the system unstable or unresponsive. The vulnerability is due to a missing channel lock when a channel is deleted.

Bluetooth L2CAP ECRED reconfiguration response handling can call l2cap_chan_del() without holding the channel lock while another thread may be iterating the same channel list. A remote BLE peer in radio range can send a crafted ECRED reconfiguration response and trigger a race that may corrupt the L2CAP channel list, leading at least to a kernel crash or connection state corruption. The issue is adjacent network reachable rather than Internet reachable because Bluetooth radio proximity is required. Red Hat Enterprise Linux 10 2026-07-21T00:00:00Z RHSA-2026:42919 kernel-0:6.12.0-211.37.1.el10_2 Red Hat Enterprise Linux 8 2026-07-21T00:00:00Z RHSA-2026:42550 kernel-rt-0:4.18.0-553.146.1.rt7.487.el8_10 Red Hat Enterprise Linux 8 2026-07-21T00:00:00Z RHSA-2026:42552 kernel-0:4.18.0-553.146.1.el8_10 Red Hat Enterprise Linux 9 2026-07-22T00:00:00Z RHSA-2026:43307 kernel-0:5.14.0-687.29.1.el9_8 Red Hat Enterprise Linux 9 2026-07-22T00:00:00Z RHSA-2026:43307 kernel-0:5.14.0-687.29.1.el9_8 Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-53071 https://nvd.nist.gov/vuln/detail/CVE-2026-53071 https://lore.kernel.org/linux-cve-announce/2026062404-CVE-2026-53071-bdae@gregkh/T