Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.28 % · percentile 21 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_chan_close() removes the channel from conn->chan_l, which must be done under conn->lock. cleanup_listen() runs under the parent sk_lock, so acquiring conn->lock would invert the established conn->lock -> chan->lock -> sk_lock order. Instead of calling l2cap_chan_close() directly, schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously. The timeout handler already acquires conn->lock and chan->lock in the correct order. The timer is only armed when chan->conn is still set: if it is already NULL, l2cap_conn_del() has already processed this channel (l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb), so there is nothing left to do. If l2cap_conn_del() races in after the timer is armed, __clear_chan_timer() inside l2cap_chan_del() cancels it; if the timer has already fired, the handler returns harmlessly because chan->conn was cleared.
Weaknesses (CWE)
- CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization
- CWE-667 — Improper Locking
References
- https://git.kernel.org/stable/c/3634cbdc2eb414b69ffa752ddbe5e0458518e321
- https://git.kernel.org/stable/c/e1c100e2d61bd8c718b7d91fe3e050780a9bf72d
- https://git.kernel.org/stable/c/deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9
- https://git.kernel.org/stable/c/89dec92041717b027216e110599e4f6d6c921b79
- https://git.kernel.org/stable/c/50dfec218808b148ab4247b1858031b7a32015c5
- https://git.kernel.org/stable/c/859d3ace791ed878ae9ba5522c7844d960da8f88
- https://git.kernel.org/stable/c/7555fd885a0603f50e49a655850a1f2bd8a25398
- https://git.kernel.org/stable/c/8c8e620467a7b51562dbcefbd1f09f288d7d710d
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-41373
- GCVE · GCVE-0-2026-53358
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1298 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1252 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1203 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1162 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0927 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 3.4 < 5.10.259cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.210cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.176cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.143cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.93cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.35cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 7.0.12cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 3df91ea20e744344100b10ae69a17211fcf5b207 < 3634cbdc2eb414b69ffa752ddbe5e0458518e321 ; affected 3df91ea20e744344100b10ae69a17211fcf5b207 < e1c100e2d61bd8c718b7d91fe3e050780a9bf72d ; affected 3df91ea20e744344100b10ae69a17211fcf5b207 < deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9 ; affected 3df91ea20e744344100b10ae69a17211fcf5b207 < 89dec92041717b027216e110599e4f6d6c921b79 ; affected 3df91ea20e744344100b10ae69a17211fcf5b207 < 50dfec218808b148ab4247b1858031b7a32015c5 ; affected 3df91ea20e744344100b10ae69a17211fcf5b207 < 859d3ace791ed878ae9ba5522c7844d960da8f88 |
| Linux · Linux | affected 3.4 ; unaffected 0 < 3.4 ; unaffected 5.10.259 ≤ 5.10.* ; unaffected 5.15.210 ≤ 5.15.* ; unaffected 6.1.176 ≤ 6.1.* ; unaffected 6.6.143 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |