CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix deadlock in l2capconndel()
l2capconndel() calls canceldelayedworksync() for both infotimer and idaddrtimer while holding conn->lock. However, the work functions l2capinfotimeout() and l2capconnupdateidaddr() both acquire conn->lock, creating a potential AB-BA deadlock if the work is already executing when l2capconndel() takes the lock.
Move the work cancellations before acquiring conn->lock and use disabledelayedworksync() to additionally prevent the works from being rearmed after cancellation, consistent with the pattern used in hciconndel().
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31499?
CVE-2026-31499 has been classified with a severity level that indicates a deadlock issue in the Bluetooth L2CAP layer of the Linux kernel.
How do I fix CVE-2026-31499?
To fix CVE-2026-31499, you need to update your Linux kernel to the latest version where the vulnerability is patched.
What systems are affected by CVE-2026-31499?
CVE-2026-31499 affects systems running the Linux kernel that utilize Bluetooth functionality.
What can happen if CVE-2026-31499 is exploited?
If exploited, CVE-2026-31499 can lead to a deadlock condition, potentially causing disruptions in Bluetooth connections.
Is there a workaround for CVE-2026-31499 while waiting for a patch?
There are no known workarounds for CVE-2026-31499, so updating the Linux kernel is the recommended course of action.