CVE-2026-64206
Received Received - Intake

Bluetooth Deadlock in Linux Kernel L2CAP

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock l2cap_conn_del() takes conn->lock and then calls cancel_work_sync() for pending_rx_work. process_pending_rx() takes the same mutex, so teardown can deadlock against the worker it is flushing. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the l2cap_conn_ready() -> queue_work(..., &conn->pending_rx_work) submit path, the l2cap_conn_del() -> cancel_work_sync(&conn->pending_rx_work) teardown path, and the process_pending_rx() -> mutex_lock(&conn->lock) worker edge. Lockdep WARNING: possible circular locking dependency detected process_pending_rx+0x21/0x2a [vuln_msv] l2cap_conn_del.constprop.0+0x3f/0x4e [vuln_msv] *** DEADLOCK *** Cancel pending_rx_work before taking conn->lock, matching the existing lock-before-drain ordering used for the two delayed works in the same teardown path. The pending_rx queue is still purged after the work has been cancelled and conn->lock has been acquired.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-64206
EUVD
EUVD-2026-46014

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel Bluetooth vulnerability where a deadlock can occur during connection teardown. The issue happens because l2cap_conn_del() takes a lock and then tries to cancel pending_rx_work, while process_pending_rx() also tries to take the same lock, creating a circular dependency that causes a deadlock.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth L2CAP implementation and may not have direct detection commands. However, you can check if your kernel version includes the fix by running: uname -r. If your kernel version is below the patched version, the vulnerability may exist. Monitor system logs for Bluetooth-related deadlock warnings or crashes.

Impact Analysis

This vulnerability could cause system hangs or crashes when Bluetooth connections are being terminated, potentially leading to denial-of-service conditions on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel locking issue in Bluetooth L2CAP. Compliance impacts would only occur if this flaw led to data breaches or system failures, which is not specified in the provided context.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, disable Bluetooth functionality temporarily to reduce exposure until the patch can be applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64206. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart