Bug 2492458 (CVE-2026-53071) - CVE-2026-53071 kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
Summary: CVE-2026-53071 kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred...
Keywords:
Status: NEW
Alias: CVE-2026-53071
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-24 18:13 UTC by OSIDB Bzimport
Modified: 2026-09-09 00:40 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:42550 0 None None None 2026-07-21 06:18:29 UTC
Red Hat Product Errata RHSA-2026:42552 0 None None None 2026-07-21 06:31:38 UTC
Red Hat Product Errata RHSA-2026:42919 0 None None None 2026-07-21 17:10:16 UTC
Red Hat Product Errata RHSA-2026:43307 0 None None None 2026-07-22 10:08:04 UTC
Red Hat Product Errata RHSA-2026:65710 0 None None None 2026-09-09 00:35:49 UTC
Red Hat Product Errata RHSA-2026:65711 0 None None None 2026-09-09 00:40:39 UTC

Description OSIDB Bzimport 2026-06-24 18:13:10 UTC 
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file
acquires the lock first. A remote BLE device can send a crafted
L2CAP ECRED reconfiguration response to corrupt the channel list
while another thread is iterating it.

Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),
and l2cap_chan_unlock() and l2cap_chan_put() after, matching the
pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
Comment 1 Mauro Matteo Cascella 2026-06-25 08:14:37 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026062404-CVE-2026-53071-bdae@gregkh/T
Comment 4 errata-xmlrpc 2026-07-21 06:18:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:42550 https://access.redhat.com/errata/RHSA-2026:42550
Comment 5 errata-xmlrpc 2026-07-21 06:31:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:42552 https://access.redhat.com/errata/RHSA-2026:42552
Comment 6 errata-xmlrpc 2026-07-21 17:10:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:42919 https://access.redhat.com/errata/RHSA-2026:42919
Comment 7 errata-xmlrpc 2026-07-22 10:08:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:43307 https://access.redhat.com/errata/RHSA-2026:43307
Comment 8 errata-xmlrpc 2026-09-09 00:35:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:65710 https://access.redhat.com/errata/RHSA-2026:65710
Comment 9 errata-xmlrpc 2026-09-09 00:40:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:65711 https://access.redhat.com/errata/RHSA-2026:65711
Note You need to log in before you can comment on or make changes to this bug.