Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could lead to system instability or crashes. The issue occurs when the system attempts to clean up Bluetooth connections in an incorrect order, potentially causing a deadlock or use-after-free scenario. This affects the reliability of Bluetooth services on Linux-based systems.
Technical details
A vulnerability in the Linux kernel Bluetooth L2CAP implementation arises from an incorrect lock acquisition order in cleanup_listen(). Specifically, calling l2cap_chan_close() directly while holding the parent sk_lock can lead to a lock inversion with conn->lock. This race condition or deadlock scenario is resolved by using an asynchronous timer (l2cap_chan_timeout) to handle channel closure, ensuring locks are acquired in the established conn->lock -> chan->lock -> sk_lock order. The fix ensures that channel cleanup is safely deferred when the connection is still active.
Affected products
- Linux Linux kernel 3df91ea20e74 to 8c8e620467a7b51562dbcefbd1f09f288d7d710d
Timeline
- 2026-07-02: advisory
References
- https://git.kernel.org/stable/c/3634cbdc2eb414b69ffa752ddbe5e0458518e321
- https://git.kernel.org/stable/c/50dfec218808b148ab4247b1858031b7a32015c5
- https://git.kernel.org/stable/c/7555fd885a0603f50e49a655850a1f2bd8a25398
- https://git.kernel.org/stable/c/859d3ace791ed878ae9ba5522c7844d960da8f88
- https://git.kernel.org/stable/c/89dec92041717b027216e110599e4f6d6c921b79
- https://git.kernel.org/stable/c/8c8e620467a7b51562dbcefbd1f09f288d7d710d
- https://git.kernel.org/stable/c/deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9