VULNERABILITY INTELLIGENCE

CVE-2026-53071

CVSS score8.8 HIGH
EPSS probability0.43%
CISA KEVNot currently listed
Published2026-06-24
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().

Weakness classification

  • nvd@nist.gov: CWE-667
  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-416
  • 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-416

Primary references