CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
Bluetooth: L2CAP: Fix deadlock in l2capconndel()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel Bluetooth L2CAP implementation, move cancellation of the info_timer and id_addr_timer work functions before acquiring conn->lock, and use disable_delayed_work_sync() to prevent the work from executing while l2cap_conn_del() holds the lock.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31499?
CVE-2026-31499 has been classified with a severity level that indicates a deadlock issue in the Bluetooth L2CAP layer of the Linux kernel.
How do I fix CVE-2026-31499?
To fix CVE-2026-31499, you need to update your Linux kernel to the latest version where the vulnerability is patched.
What systems are affected by CVE-2026-31499?
CVE-2026-31499 affects systems running the Linux kernel that utilize Bluetooth functionality.
What can happen if CVE-2026-31499 is exploited?
If exploited, CVE-2026-31499 can lead to a deadlock condition, potentially causing disruptions in Bluetooth connections.
Is there a workaround for CVE-2026-31499 while waiting for a patch?
There are no known workarounds for CVE-2026-31499, so updating the Linux kernel is the recommended course of action.