Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 15f02b91056253e8cdc592888f431da0731337b8 before 96dca51715d86559ed6ed8028e5445cecb80f3ae; affected 15f02b91056253e8cdc592888f431da0731337b8 before 330b20ec97916961ee0e6c29c06bc0fa7c96e64c; affected 15f02b91056253e8cdc592888f431da0731337b8 before 0ccd75c51f620374086f359e906917676e699a1c; affected 15f02b91056253e8cdc592888f431da0731337b8 before 77a853aec710b2fdf41fa298ea3cbc9a4358f917; affected 15f02b91056253e8cdc592888f431da0731337b8 before fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14; affected 15f02b91056253e8cdc592888f431da0731337b8 before dc89961b76f12aff47124c1df4bdb32a080f4d0c; affected 15f02b91056253e8cdc592888f431da0731337b8 before 5501d055a1ce3c747141e3955ba8cf034d193f3e; affected 15f02b91056253e8cdc592888f431da0731337b8 before 42776497cdbc9a665b384a6dcb85f0d4bd927eab |
| Linux / Linux | affected 5.7; unaffected 0 before 5.7; unaffected 5.10.258 through 5.10.*; unaffected 5.15.209 through 5.15.*; unaffected 6.1.175 through 6.1.*; unaffected 6.6.141 through 6.6.*; unaffected 6.12.91 through 6.12.*; unaffected 6.18.33 through 6.18.*; unaffected 7.0.10 through 7.0.*; unaffected 7.1 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/96dca51715d86559ed6ed8028e5445cecb80f3ae
- https://git.kernel.org/stable/c/330b20ec97916961ee0e6c29c06bc0fa7c96e64c
- https://git.kernel.org/stable/c/0ccd75c51f620374086f359e906917676e699a1c
- https://git.kernel.org/stable/c/77a853aec710b2fdf41fa298ea3cbc9a4358f917
- https://git.kernel.org/stable/c/fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14
- https://git.kernel.org/stable/c/dc89961b76f12aff47124c1df4bdb32a080f4d0c
- https://git.kernel.org/stable/c/5501d055a1ce3c747141e3955ba8cf034d193f3e
- https://git.kernel.org/stable/c/42776497cdbc9a665b384a6dcb85f0d4bd927eab
ADP enrichment
A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. A remote Bluetooth Low Energy (BLE) device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list, potentially causing a Denial of Service (DoS) by making the system unstable or unresponsive. The vulnerability is due to a missing channel lock when a channel is deleted.
- https://access.redhat.com/security/cve/CVE-2026-53071
- https://bugzilla.redhat.com/show_bug.cgi?id=2492458
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53071.json
- https://access.redhat.com/errata/RHSA-2026:42919
- https://access.redhat.com/errata/RHSA-2026:67723
- https://access.redhat.com/errata/RHSA-2026:43307
- https://access.redhat.com/errata/RHSA-2026:42552
- https://access.redhat.com/errata/RHSA-2026:65710
- https://access.redhat.com/errata/RHSA-2026:65711
- https://access.redhat.com/errata/RHSA-2026:42550
- https://access.redhat.com/errata/RHSA-2026:67721
No English description supplied.
No references supplied.