CVE-2026-23461 Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
A race condition in the Linux kernel Bluetooth L2CAP subsystem allows attackers to trigger a use-after-free, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23461?
CVE-2026-23461 is a high-severity use after free vulnerability in Linux kernel, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
After commit ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del"), l2cap_conn_del() uses conn->lock to protect access to conn->users. However, l2cap_register_user() and l2cap_unregister_user() don't use conn->lock, creating a race condition where these functions can access conn->users and conn->hchan concurrently with l2cap_conn_del().
This can lead to use-after-free and list corruption bugs, as reported by syzbot.
Fix this by changing l2cap_register_user() and l2cap_unregister_user() to use conn->lock instead of hci_dev_lock(), ensuring consistent locking for the l2cap_conn structure.
Which versions are affected by CVE-2026-23461?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23461?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-23461 being exploited?
There is no known exploitation of CVE-2026-23461 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23461, DEBIAN-CVE-2026-23461, GHSA-ggw5-jw3c-r95v, ROOT-OS-DEBIAN-13-CVE-2026-23461, ROOT-OS-UBUNTU-2404-CVE-2026-23461, UBUNTU-CVE-2026-23461.