CVE-2026-53071
Description
A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. A remote Bluetooth Low Energy (BLE) device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list, potentially causing a Denial of Service (DoS) by making the system unstable or unresponsive. The vulnerability is due to a missing channel lock when a channel is deleted.
Statement
Bluetooth L2CAP ECRED reconfiguration response handling can call l2cap_chan_del() without holding the channel lock while another thread may be iterating the same channel list. A remote BLE peer in radio range can send a crafted ECRED reconfiguration response and trigger a race that may corrupt the L2CAP channel list, leading at least to a kernel crash or connection state corruption. The issue is adjacent network reachable rather than Internet reachable because Bluetooth radio proximity is required.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Adjacent Network | N/A | Adjacent Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory
The use of previously freed memory may corrupt valid data, if the memory area in question has been allocated and used properly elsewhere.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If chunk consolidation occurs after the use of previously freed data, the process may crash when invalid data is used as chunk information.
Confidentiality
Technical Impact: Read Memory
Read operations on freed memory can sometimes leak sensitive information instead of causing a crash
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If malicious data is entered before chunk consolidation can take place, it may be possible to take advantage of a write-what-where primitive to execute arbitrary code. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap data. If one of these function pointers is overwritten with an address to valid shellcode, execution of arbitrary code can be achieved.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
