Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-53071: Linux Bluetooth: Missing Lock Causes Channel Corruption
CVE-2026-53071
CVE-2026-53071
Summary
A security issue in the Linux Bluetooth system can allow a remote device to corrupt the channel list, potentially causing system instability or crashes. This issue has been fixed in the latest Linux kernel updates. If you use Linux with Bluetooth, it's recommended to update your system to the latest version to ensure you have this fix.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| linux | linux |
< 96dca51715d86559ed6ed8028e5445cecb80f3ae 5.7 |
| linux | linux_kernel |
>= 5.7, < 5.10.258 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.141 >= 6.7, < 6.12.91 >= 6.13, < 6.18.33 >= 6.19, < 7.0.10 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
Original title
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
Original description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file
acquires the lock first. A remote BLE device can send a crafted
L2CAP ECRED reconfiguration response to corrupt the channel list
while another thread is iterating it.
Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),
and l2cap_chan_unlock() and l2cap_chan_put() after, matching the
pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file
acquires the lock first. A remote BLE device can send a crafted
L2CAP ECRED reconfiguration response to corrupt the channel list
while another thread is iterating it.
Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),
and l2cap_chan_unlock() and l2cap_chan_put() after, matching the
pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
nvd CVSS3.1
8.8
Vulnerability type
CWE-416
Use After Free
CWE-667
Improper Locking
- https://git.kernel.org/stable/c/0ccd75c51f620374086f359e906917676e699a1c
- https://git.kernel.org/stable/c/330b20ec97916961ee0e6c29c06bc0fa7c96e64c
- https://git.kernel.org/stable/c/42776497cdbc9a665b384a6dcb85f0d4bd927eab
- https://git.kernel.org/stable/c/5501d055a1ce3c747141e3955ba8cf034d193f3e
- https://git.kernel.org/stable/c/77a853aec710b2fdf41fa298ea3cbc9a4358f917
- https://git.kernel.org/stable/c/96dca51715d86559ed6ed8028e5445cecb80f3ae
- https://git.kernel.org/stable/c/dc89961b76f12aff47124c1df4bdb32a080f4d0c
- https://git.kernel.org/stable/c/fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14
- https://access.redhat.com/security/cve/CVE-2026-53071
- https://bugzilla.redhat.com/show_bug.cgi?id=2492458
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53071.json
- https://access.redhat.com/errata/RHSA-2026:42550 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:42552 Third Party Advisory
Published: 24 Jun 2026 · Updated: 22 Jul 2026 · First seen: 28 Jun 2026