CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
Bluetooth: l2cap: Add missing chan lock in l2capecredreconfrsp
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Compensating control
Apply the kernel change described: in l2cap_ecred_reconf_rsp(), add missing l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and ensure l2cap_chan_unlock() and l2cap_chan_put() are called after l2cap_chan_del() (matching the locking pattern used by other l2cap_chan_del callers such as l2cap_ecred_conn_rsp() / l2cap_conn_del()). This prevents concurrent iteration from corrupting the channel list.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Systems running an affected Linux kernel with Bluetooth Low Energy connectivity are exposed when they can interact with a remote BLE device. The CVSS vector indicates adjacent-network attack access, with no privileges or user interaction required.
What does an attacker need to send?
An attacker needs to send a crafted L2CAP ECRED reconfiguration response from a remote BLE device. The corruption occurs when the response causes channel deletion while another thread is iterating the channel list.
What is the impact of successful exploitation?
The vulnerability can corrupt the Bluetooth L2CAP channel list and is classified as a use-after-free issue. The supplied CVSS metrics rate confidentiality, integrity, and availability impact as high.
Which products are identified in the available data?
The listed affected software includes the Linux kernel and Microsoft azl3 kernel version 6.6.139.1-1. No broader version range or default Bluetooth configuration status is provided.