CVE-2026-53071
published 2026-06-24CVE-2026-53071: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp()…
PriorityP346high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.27%
18.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file
acquires the lock first. A remote BLE device can send a crafted
L2CAP ECRED reconfiguration response to corrupt the channel list
while another thread is iterating it.
Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),
and l2cap_chan_unlock() and l2cap_chan_put() after, matching the
pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 15f02b91056253e8cdc592888f431da0731337b8 < 96dca51715d86559ed6ed8028e5445cecb80f3ae | 96dca51715d86559ed6ed8028e5445cecb80f3ae |
| linux | linux | >= 15f02b91056253e8cdc592888f431da0731337b8 < 330b20ec97916961ee0e6c29c06bc0fa7c96e64c | 330b20ec97916961ee0e6c29c06bc0fa7c96e64c |
| linux | linux | >= 15f02b91056253e8cdc592888f431da0731337b8 < 0ccd75c51f620374086f359e906917676e699a1c | 0ccd75c51f620374086f359e906917676e699a1c |
| linux | linux | >= 15f02b91056253e8cdc592888f431da0731337b8 < 77a853aec710b2fdf41fa298ea3cbc9a4358f917 | 77a853aec710b2fdf41fa298ea3cbc9a4358f917 |
| linux | linux | >= 15f02b91056253e8cdc592888f431da0731337b8 < fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14 | fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14 |
| linux | linux | >= 15f02b91056253e8cdc592888f431da0731337b8 < dc89961b76f12aff47124c1df4bdb32a080f4d0c | dc89961b76f12aff47124c1df4bdb32a080f4d0c |
| linux | linux | >= 15f02b91056253e8cdc592888f431da0731337b8 < 5501d055a1ce3c747141e3955ba8cf034d193f3e | 5501d055a1ce3c747141e3955ba8cf034d193f3e |
| linux | linux | >= 15f02b91056253e8cdc592888f431da0731337b8 < 42776497cdbc9a665b384a6dcb85f0d4bd927eab | 42776497cdbc9a665b384a6dcb85f0d4bd927eab |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.0.9 Bluetooth l2cap_ecred_reconf_rsp locking (WID-SEC-2026-2077)
vuldb·2026-06-27
CVE-2026-53071 [CRITICAL] Linux Kernel up to 7.0.9 Bluetooth l2cap_ecred_reconf_rsp locking (WID-SEC-2026-2077)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 7.0.9. This impacts the function l2cap_ecred_reconf_rsp of the component Bluetooth. Such manipulation leads to improper locking.
This vulnerability is uniquely identified as CVE-2026-53071. The attack can only be initiated within the local network. No exploit exists.
You should upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
ghsa_unreviewed·2026-06-24
CVE-2026-53071 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file
acquires the lock first. A remote BLE device can send a crafted
L2CAP ECRED reconfiguration response to corrupt the channel list
while another thread is iterating it.
Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),
and l2cap_chan_unlock() and l2cap_chan_put() after, matching the
pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
Red Hat
kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
vendor_redhat·2026-06-24·CVSS 7.0
CVE-2026-53071 [HIGH] CWE-414 kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. A remote Bluetooth Low Energy (BLE) device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list, potentially causing a Denial of Service (DoS) by making the system unstable or unresponsive. The vulnerability is due to a missing channel lock when a channel is deleted.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package:
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0ccd75c51f620374086f359e906917676e699a1chttps://git.kernel.org/stable/c/330b20ec97916961ee0e6c29c06bc0fa7c96e64chttps://git.kernel.org/stable/c/42776497cdbc9a665b384a6dcb85f0d4bd927eabhttps://git.kernel.org/stable/c/5501d055a1ce3c747141e3955ba8cf034d193f3ehttps://git.kernel.org/stable/c/77a853aec710b2fdf41fa298ea3cbc9a4358f917https://git.kernel.org/stable/c/96dca51715d86559ed6ed8028e5445cecb80f3aehttps://git.kernel.org/stable/c/dc89961b76f12aff47124c1df4bdb32a080f4d0chttps://git.kernel.org/stable/c/fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14https://access.redhat.com/security/cve/CVE-2026-53071https://bugzilla.redhat.com/show_bug.cgi?id=2492458https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53071.json
2026-06-24
Published