Executive Summary

This vulnerability exists in the Linux kernel's Bluetooth L2CAP component. Specifically, the function l2cap_conn_del() calls cancel_delayed_work_sync() on two timers while holding a lock (conn->lock). However, the work functions that are canceled also try to acquire the same lock, which can cause a deadlock situation if the work is already running when l2cap_conn_del() tries to take the lock.

The deadlock occurs because l2cap_conn_del() holds the lock and waits for the work functions to finish, but those work functions are blocked waiting to acquire the same lock, creating a circular wait (AB-BA deadlock). The fix involves moving the cancellation of the work before acquiring the lock and using disable_delayed_work_sync() to prevent the work from restarting after cancellation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a deadlock in the Bluetooth L2CAP subsystem of the Linux kernel, potentially leading to system instability or unresponsiveness related to Bluetooth connections. If the deadlock occurs, Bluetooth functionality may hang or become unavailable, which could disrupt applications or services relying on Bluetooth communication.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by modifying the Linux kernel Bluetooth L2CAP code to avoid a deadlock condition. To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix for CVE-2026-31499.

Specifically, ensure your system is running a kernel version where the l2cap_conn_del() function has been corrected to move work cancellations before acquiring the connection lock and uses disable_delayed_work_sync() to prevent rearming of works after cancellation.

Useful 0 Not Useful 0