CVE-2026-53358

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_chan_close() removes the channel from conn->chan_l, which must be done under conn->lock. cleanup_listen() runs under the parent sk_lock, so acquiring conn->lock would invert the established conn->lock -> chan->lock -> sk_lock order. Instead of calling l2cap_chan_close() directly, schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously. The timeout handler already acquires conn->lock and chan->lock in the correct order. The time...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 3df91ea20e744344100b10ae69a17211fcf5b207 < 3634cbdc2eb414b69ffa752ddbe5e0458518e321, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < e1c100e2d61bd8c718b7d91fe3e050780a9bf72d, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 89dec92041717b027216e110599e4f6d6c921b79, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 50dfec218808b148ab4247b1858031b7a32015c5, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 859d3ace791ed878ae9ba5522c7844d960da8f88, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 7555fd885a0603f50e49a655850a1f2bd8a25398, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 8c8e620467a7b51562dbcefbd1f09f288d7d710d, >= 3.4, >= 3.4 < 5.10.259, >= 5.11 < 5.15.210, >= 5.16 < 6.1.176, >= 6.2 < 6.6.143, >= 6.7 < 6.12.93, >= 6.13 < 6.18.35, >= 6.19 < 7.0.12, 7.1

Fixed versions

5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12

Technical data

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-667