Junglewise Threat Intelligence

CVE-2026-53357: Linux Kernel use-after-free in Bluetooth l2cap_sock_cleanup_listen

CVE-2026-53357 · Severity: info · Published 2026-07-02

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A security vulnerability was identified in the Linux kernel's Bluetooth subsystem. The issue occurs when the system attempts to clean up Bluetooth connections that haven't been fully accepted yet while a simultaneous disconnection event happens. This can lead to a system crash or unpredictable behavior because the software tries to access memory that has already been freed. An unprivileged local user could potentially trigger this race condition to cause a denial-of-service (system crash).

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel Bluetooth subsystem, specifically within the interaction between `l2cap_sock_cleanup_listen()` and `l2cap_conn_del()`. The root cause is that `bt_accept_dequeue()` unlinks a child socket from the parent's accept queue and releases the socket lock before returning, leaving the returned socket without a caller reference. If a concurrent HCI disconnect triggers `l2cap_conn_del()`, it can free the child socket and its associated L2CAP channel while `cleanup_listen()` is still attempting to access them. This race condition can be triggered by unprivileged users performing listen/close operations during HCI-disconnect events. The fix involves taking a proper reference (`sock_hold`) while the socket is still locked in `bt_accept_dequeue()` and ensuring proper pinning of the channel during cleanup. Patches have been merged into various stable kernel branches.

Affected products

  • Linux Linux Kernel versions including 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.9.y, 6.10.y, 6.11.y, 6.12.y, 6.13.y

Timeline

  • 2026-05-29: patched: Initial patch authored for stable branches
  • 2026-07-02: advisory: CVE-2026-53357 published

References

Related threats