CVE-2026-23461
Analyzed Analyzed - Analysis Complete
Use-After-Free in Linux Kernel Bluetooth L2CAP Due to Race Condition

Publication date: 2026-04-03

Last updated on: 2026-05-20

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user After commit ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del"), l2cap_conn_del() uses conn->lock to protect access to conn->users. However, l2cap_register_user() and l2cap_unregister_user() don't use conn->lock, creating a race condition where these functions can access conn->users and conn->hchan concurrently with l2cap_conn_del(). This can lead to use-after-free and list corruption bugs, as reported by syzbot. Fix this by changing l2cap_register_user() and l2cap_unregister_user() to use conn->lock instead of hci_dev_lock(), ensuring consistent locking for the l2cap_conn structure.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-03
Last Modified
2026-05-20
Generated
2026-06-16
AI Q&A
2026-04-03
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23461
EUVD
EUVD-2026-18722
Affected Vendors & Products
Showing 15 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.14
linux linux_kernel 6.14
linux linux_kernel 6.14
linux linux_kernel 6.14
linux linux_kernel 6.14
linux linux_kernel 6.14
linux linux_kernel From 6.13.8 (inc) to 6.14 (exc)
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.19 (inc) to 6.19.10 (exc)
linux linux_kernel From 6.12.20 (inc) to 6.12.78 (exc)
linux linux_kernel From 6.14.1 (inc) to 6.18.20 (exc)
linux linux_kernel From 6.6.84 (inc) to 6.6.130 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's Bluetooth L2CAP component. It is caused by inconsistent locking mechanisms when accessing certain data structures related to L2CAP connections. Specifically, after a certain commit, the function l2cap_conn_del() uses a lock (conn->lock) to protect access to connection users, but the functions l2cap_register_user() and l2cap_unregister_user() do not use this lock and instead use a different lock (hci_dev_lock). This mismatch creates a race condition where these functions can concurrently access shared data, leading to use-after-free and list corruption bugs.

The issue was reported by syzbot and fixed by changing l2cap_register_user() and l2cap_unregister_user() to use the same lock (conn->lock) as l2cap_conn_del(), ensuring consistent locking and preventing the race condition.

Impact Analysis

This vulnerability can lead to use-after-free and list corruption bugs in the Bluetooth L2CAP subsystem of the Linux kernel. Such issues can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service by exploiting the race condition.

Mitigation Strategies

The vulnerability is fixed by ensuring that l2cap_register_user() and l2cap_unregister_user() use the conn->lock instead of hci_dev_lock(), providing consistent locking for the l2cap_conn structure.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix for this issue, specifically the commit ab4eedb790ca or later.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23461. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart