Bug 2460692 (CVE-2026-31499)

Summary: CVE-2026-31499 kernel: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's Bluetooth L2CAP component. A deadlock can occur in the `l2cap_conn_del()` function when canceling delayed work, specifically `info_timer` and `id_addr_timer`. This happens because `l2cap_conn_del()` holds a lock while attempting to cancel work functions that also acquire the same lock, creating a circular waiting condition. This concurrency issue can lead to a Denial of Service (DoS), making the system unresponsive.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-22 15:05:47 UTC 
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()

l2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer
and id_addr_timer while holding conn->lock. However, the work functions
l2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire
conn->lock, creating a potential AB-BA deadlock if the work is already
executing when l2cap_conn_del() takes the lock.

Move the work cancellations before acquiring conn->lock and use
disable_delayed_work_sync() to additionally prevent the works from
being rearmed after cancellation, consistent with the pattern used in
hci_conn_del().
Comment 1 Keith Grant 2026-04-22 19:19:45 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026042204-CVE-2026-31499-0142@gregkh/T