CVE-2026-23461
Use-After-Free in Linux Kernel Bluetooth L2CAP Due to Race Condition
Publication date: 2026-04-03
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (inc) |
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Bluetooth L2CAP component. It is caused by inconsistent locking mechanisms when accessing certain data structures related to L2CAP connections. Specifically, after a certain commit, the function l2cap_conn_del() uses a lock (conn->lock) to protect access to connection users, but the functions l2cap_register_user() and l2cap_unregister_user() do not use this lock and instead use a different lock (hci_dev_lock). This mismatch creates a race condition where these functions can concurrently access shared data, leading to use-after-free and list corruption bugs.
The issue was reported by syzbot and fixed by changing l2cap_register_user() and l2cap_unregister_user() to use the same lock (conn->lock) as l2cap_conn_del(), ensuring consistent locking and preventing the race condition.
How can this vulnerability impact me? :
This vulnerability can lead to use-after-free and list corruption bugs in the Bluetooth L2CAP subsystem of the Linux kernel. Such issues can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service by exploiting the race condition.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by ensuring that l2cap_register_user() and l2cap_unregister_user() use the conn->lock instead of hci_dev_lock(), providing consistent locking for the l2cap_conn structure.
To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix for this issue, specifically the commit ab4eedb790ca or later.