CVE-2026-53358
published 2026-07-02CVE-2026-53358: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_chan_close()…
PriorityP343high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.20%
9.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
l2cap_chan_close() removes the channel from conn->chan_l, which
must be done under conn->lock. cleanup_listen() runs under the
parent sk_lock, so acquiring conn->lock would invert the
established conn->lock -> chan->lock -> sk_lock order.
Instead of calling l2cap_chan_close() directly, schedule
l2cap_chan_timeout with delay 0 to close the channel
asynchronously. The timeout handler already acquires conn->lock
and chan->lock in the correct order.
The timer is only armed when chan->conn is still set: if it is
already NULL, l2cap_conn_del() has already processed this channel
(l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb),
so there is nothing left to do. If l2cap_conn_del() races in
after the timer is armed, __clear_chan_timer() inside
l2cap_chan_del() cancels it; if the timer has already fired, the
handler returns harmlessly because chan->conn was cleared.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 3634cbdc2eb414b69ffa752ddbe5e0458518e321 | 3634cbdc2eb414b69ffa752ddbe5e0458518e321 |
| linux | linux | >= 3df91ea20e744344100b10ae69a17211fcf5b207 < e1c100e2d61bd8c718b7d91fe3e050780a9bf72d | e1c100e2d61bd8c718b7d91fe3e050780a9bf72d |
| linux | linux | >= 3df91ea20e744344100b10ae69a17211fcf5b207 < deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9 | deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9 |
| linux | linux | >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 89dec92041717b027216e110599e4f6d6c921b79 | 89dec92041717b027216e110599e4f6d6c921b79 |
| linux | linux | >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 50dfec218808b148ab4247b1858031b7a32015c5 | 50dfec218808b148ab4247b1858031b7a32015c5 |
| linux | linux | >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 859d3ace791ed878ae9ba5522c7844d960da8f88 | 859d3ace791ed878ae9ba5522c7844d960da8f88 |
| linux | linux | >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 7555fd885a0603f50e49a655850a1f2bd8a25398 | 7555fd885a0603f50e49a655850a1f2bd8a25398 |
| linux | linux | >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 8c8e620467a7b51562dbcefbd1f09f288d7d710d | 8c8e620467a7b51562dbcefbd1f09f288d7d710d |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 3.4 < 5.10.259 | 5.10.259 |
| linux | linux_kernel | >= 5.11 < 5.15.210 | 5.15.210 |
| linux | linux_kernel | >= 5.16 < 6.1.176 | 6.1.176 |
| linux | linux_kernel | >= 6.13 < 6.18.35 | 6.18.35 |
| linux | linux_kernel | >= 6.19 < 7.0.12 | 7.0.12 |
| linux | linux_kernel | >= 6.2 < 6.6.143 | 6.6.143 |
| linux | linux_kernel | >= 6.7 < 6.12.93 | 6.12.93 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-azure | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu7.0HIGH
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-28·CVSS 7.0
CVE-2026-64231 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platform drivers;
- Cryptographic API;
- PSP security protocol;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 archit
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-64107 [LOW] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platfor
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.0
CVE-2026-64107 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platform drivers;
- PSP security protocol;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 7.0
CVE-2026-46108 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PSP security protocol;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Intel NPU Driver;
- DRBD D
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TC
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 7.0
CVE-2026-46113 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PSP security protocol;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Intel NPU Driver;
- DRBD Distrib
Red Hat
kernel: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
vendor_redhat·2026-07-02·CVSS 5.5
CVE-2026-53358 [MEDIUM] CWE-413 kernel: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
kernel: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation. This vulnerability arises from an incorrect order of acquiring locks during channel cleanup, which could lead to a race condition. This issue could potentially cause instability or unexpected behavior within the Bluetooth subsystem. The fix involves using a channel timer to close channels asynchronously, ensuring proper lock acquisition.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 7) - Fix deferred
Package: kern
GHSA
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_chan_close() removes the channel from conn->chan_l, w
ghsa_unreviewed·2026-07-02
CVE-2026-53358 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_chan_close() removes the channel from conn->chan_l, w
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
l2cap_chan_close() removes the channel from conn->chan_l, which
must be done under conn->lock. cleanup_listen() runs under the
parent sk_lock, so acquiring conn->lock would invert the
established conn->lock -> chan->lock -> sk_lock order.
Instead of calling l2cap_chan_close() directly, schedule
l2cap_chan_timeout with delay 0 to close the channel
asynchronously. The timeout handler already acquires conn->lock
and chan->lock in the correct order.
The timer is only armed when chan->conn is still set: if it is
already NULL, l2cap_conn_del() has already processed this channel
(l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb),
so there is n
VulDB
Linux Kernel up to 7.0.11 Bluetooth cleanup_listen chan_l locking
vuldb·2026-07-02
CVE-2026-53358 [CRITICAL] Linux Kernel up to 7.0.11 Bluetooth cleanup_listen chan_l locking
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.0.11. This issue affects the function cleanup_listen of the component Bluetooth. The manipulation of the argument chan_l leads to improper locking.
This vulnerability is traded as CVE-2026-53358. Access to the local network is required for this attack to succeed. There is no exploit available.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/3634cbdc2eb414b69ffa752ddbe5e0458518e321https://git.kernel.org/stable/c/50dfec218808b148ab4247b1858031b7a32015c5https://git.kernel.org/stable/c/7555fd885a0603f50e49a655850a1f2bd8a25398https://git.kernel.org/stable/c/859d3ace791ed878ae9ba5522c7844d960da8f88https://git.kernel.org/stable/c/89dec92041717b027216e110599e4f6d6c921b79https://git.kernel.org/stable/c/8c8e620467a7b51562dbcefbd1f09f288d7d710dhttps://git.kernel.org/stable/c/deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9https://git.kernel.org/stable/c/e1c100e2d61bd8c718b7d91fe3e050780a9bf72d
2026-07-02
Published