CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2capunregisteruser
After commit ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hcichandel"), l2capconndel() uses conn->lock to protect access to conn->users. However, l2capregisteruser() and l2capunregisteruser() don't use conn->lock, creating a race condition where these functions can access conn->users and conn->hchan concurrently with l2capconndel().
This can lead to use-after-free and list corruption bugs, as reported by syzbot.
Fix this by changing l2capregisteruser() and l2capunregisteruser() to use conn->lock instead of hcidevlock(), ensuring consistent locking for the l2capconn structure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23461?
CVE-2026-23461 has a severity rating of high, with a score of 8.8.
How do I fix CVE-2026-23461?
To fix CVE-2026-23461, update the Linux kernel to the latest version that has resolved this use-after-free vulnerability.
What are the implications of CVE-2026-23461?
CVE-2026-23461 can lead to potentially exploitable conditions such as arbitrary code execution due to the use-after-free vulnerability.
Which software is affected by CVE-2026-23461?
CVE-2026-23461 affects the Bluetooth L2CAP component in the Linux kernel.
What types of vulnerabilities does CVE-2026-23461 include?
CVE-2026-23461 includes types of vulnerabilities such as Use After Free and Race Condition.