CVE-2026-31499

A flaw was found in the Linux kernel's Bluetooth L2CAP component. A deadlock can occur in the l2cap_conn_del() function when canceling delayed work, specifically info_timer and id_addr_timer. This happens because l2cap_conn_del() holds a lock while attempting to cancel work functions that also acquire the same lock, creating a circular waiting condition. This concurrency issue can lead to a Denial of Service (DoS), making the system unresponsive.

Red Hat acknowledges the AB-BA deadlock between conn->lock and delayed work cancellation fixed by reordering to disable_delayed_work_sync() before taking the lock. Impact is availability for systems actively tearing down L2CAP connections. Patch via kernel errata; Bluetooth unload remains an operational workaround.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the bluetooth module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.