Executive brief
A flaw in the Linux kernel's Bluetooth component can cause the system to stop responding (deadlock) during the disconnection of a Bluetooth device. This occurs because two internal processes try to access the same resource simultaneously, leading to a permanent hang of the Bluetooth subsystem. This could result in a denial of service where Bluetooth functionality becomes unavailable until the system is rebooted.
Technical details
A deadlock vulnerability exists in the Linux kernel Bluetooth L2CAP implementation due to a circular locking dependency between l2cap_conn_del() and process_pending_rx(). The function l2cap_conn_del() acquires the 'conn->lock' mutex and subsequently calls cancel_work_sync() for 'pending_rx_work'. However, the worker function process_pending_rx() also attempts to acquire 'conn->lock', creating a condition where the teardown process waits for a worker that is blocked by the teardown process itself. This issue was identified via static analysis and confirmed with a Proof of Concept (PoC) using Lockdep. The fix involves reordering the operations to cancel the pending work before acquiring the mutex. Patches have been merged into stable kernel branches.
Affected products
- Linux Linux Kernel 3.15.5 to 7.2-rc3
Timeline
- 2026-06-17: other: Vulnerability fixed in upstream kernel source
- 2026-07-20: disclosed: CVE published