CVE-2026-53358

A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation. This vulnerability arises from an incorrect order of acquiring locks during channel cleanup, which could lead to a race condition. This issue could potentially cause instability or unexpected behavior within the Bluetooth subsystem. The fix involves using a channel timer to close channels asynchronously, ensuring proper lock acquisition.

This vulnerability is rated as Moderate for Red Hat Enterprise Linux because exploitation requires local access to trigger a lock inversion in the Bluetooth subsystem, resulting in a denial of service without compromising confidentiality or integrity. On standard enterprise server deployments, Bluetooth interfaces are generally not present or active, significantly limiting practical exposure. In environments where Bluetooth is enabled, a local user with access to create and close listening sockets could potentially cause a kernel deadlock or crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.