CVE-2026-23461

A flaw was found in the Linux kernel's Bluetooth L2CAP component. A race condition exists due to inconsistent locking mechanisms when registering and unregistering L2CAP users. This allows concurrent access to shared data structures, leading to use-after-free vulnerabilities and list corruption bugs. Exploitation of this flaw could result in a denial of service.

l2cap_conn_del() took conn->lock for conn->users but register/unregister paths did not, allowing races with teardown. Bluetooth peers can influence timing; local stack interaction is required. Impact is memory corruption and likely crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.