CVE-2026-53071

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. A remote Bluetooth Low Energy (BLE) device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list, potentially causing a Denial of Service (DoS) by making the system unstable or unresponsive. The vulnerability is due to a missing channel lock when a channel is deleted.

Bluetooth L2CAP ECRED reconfiguration response handling can call l2cap_chan_del() without holding the channel lock while another thread may be iterating the same channel list. A remote BLE peer in radio range can send a crafted ECRED reconfiguration response and trigger a race that may corrupt the L2CAP channel list, leading at least to a kernel crash or connection state corruption. The issue is adjacent network reachable rather than Internet reachable because Bluetooth radio proximity is required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.