CVE-2026-23461

Vulnerability

Analysis

The Linux kernel's Bluetooth L2CAP subsystem suffers from a use-after-free and list corruption vulnerability in the l2cap_unregister_user function. The root cause is a locking inconsistency: after commit ab4eedb790ca introduced the use of conn->lock to protect access to conn->users in l2cap_conn_del(), the functions l2cap_register_user() and l2cap_unregister_user() were not updated to use the same lock. Instead, they continued using hci_dev_lock(), leading to a race condition where these functions can access conn->users and conn->hchan concurrently with l2cap_conn_del() [1].

Exploitation

Prerequisites

An attacker needs to be able to trigger Bluetooth L2CAP connection events and user registration/unregistration operations. This requires local access to the system and the ability to interact with the Bluetooth stack, potentially through crafted Bluetooth packets or by manipulating user-space applications that use L2CAP sockets. The race window is narrow, making exploitation non-trivial but possible, as demonstrated by syzbot reports [2].

Impact

Successful exploitation can lead to use-after-free conditions where an attacker can corrupt kernel memory, potentially leading to a denial of service (system crash) or arbitrary code execution with kernel privileges. The list corruption also destabilizes the Bluetooth subsystem [3].

Mitigation

The fix changes l2cap_register_user() and l2cap_unregister_user() to use conn->lock instead of hci_dev_lock(), ensuring consistent locking for the l2cap_conn structure. The patch has been applied to the stable kernel trees as of April 2026 [4]. Users should update their kernels to include commit 71030f3b3015 or its backports.