Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow a local user to cause a system crash or freeze. This occurs due to a technical conflict (deadlock) when the system attempts to clean up Bluetooth connections. While it does not allow for data theft, it can disrupt operations and impact system availability.
Technical details
A deadlock (AB-BA) exists in net/bluetooth/l2cap_core.c within the l2cap_conn_del() function. The vulnerability is caused by l2cap_conn_del() calling cancel_delayed_work_sync() for info_timer and id_addr_timer while holding the conn->lock mutex. Simultaneously, the work functions l2cap_info_timeout() and l2cap_conn_update_id_addr() attempt to acquire the same lock. A local attacker can trigger this race condition to cause a kernel deadlock, resulting in a denial of service. The fix involves moving work cancellation before the lock acquisition and using disable_delayed_work_sync() to prevent rearming.
Affected products
- Linux Linux Kernel 6.6.84 to 6.7, 6.12.20 to 6.13, 6.13.8 to 6.14, 6.14.1 to 6.18.21, 6.19 to 6.19.11
Timeline
- 2026-04-22: advisory: Initial disclosure by kernel.org
- 2026-04-22: disclosed
- 2026-03-25: patched: Initial patch committed to stable tree