Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow a nearby attacker to cause a system crash. The issue occurs when the system receives a specific type of Bluetooth connection response that conflicts with an existing connection. This results in a denial-of-service condition, potentially disrupting operations on devices using Bluetooth.
Technical details
A vulnerability in 'net/bluetooth/l2cap_core.c' within the Linux kernel's L2CAP implementation arises during the handling of 'l2cap_ecred_conn_rsp'. When a Destination CID (DCID) is received that is already assigned, the Bluetooth specification requires both channels to be discarded. However, the original implementation called 'l2cap_chan_del' while iterating through the channel list using 'list_for_each_entry_safe'. This could invalidate the temporary cursor or lead to improper channel state management, resulting in a kernel crash. The fix involves using 'l2cap_chan_timeout' with a zero delay to close the channel asynchronously, avoiding list corruption during iteration. This is reachable via adjacent Bluetooth communication.
Affected products
- Linux Linux Kernel 5.7 to 6.9.x
Timeline
- 2026-05-11: other: Patch authored
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/291eec1041c918c460dc9702e44edd17794b4a4b
- https://git.kernel.org/stable/c/3c8eaa91eb433c450426539290be4ffe282e9f00
- https://git.kernel.org/stable/c/41c2713b204e6cb6a94587bc6bf6935107df5479
- https://git.kernel.org/stable/c/41e29548b5e8b5e5fcf708786b3bea67cab107fa
- https://git.kernel.org/stable/c/6319b38fe69f56ed95680ade485b957a53fff642
- https://git.kernel.org/stable/c/d153b8898c0051eb8b6a083b35cbe304a5886bd5
- https://git.kernel.org/stable/c/e6833e737a51db1e5ea0401322acf5e22abd8be6