CVE-2026-53071 Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
A remote attacker can trigger a race condition in the Linux kernel Bluetooth stack to corrupt memory, potentially leading to code execution or system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53071?
CVE-2026-53071 is a high-severity vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it.
Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
Which versions are affected by CVE-2026-53071?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53071?
Apply the vendor's patch.
Is CVE-2026-53071 being exploited?
There is no known exploitation of CVE-2026-53071 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53071, DEBIAN-CVE-2026-53071, GHSA-g7cw-xhg8-933g, ROOT-OS-DEBIAN-11-CVE-2026-53071, ROOT-OS-DEBIAN-12-CVE-2026-53071, ROOT-OS-UBUNTU-2204-CVE-2026-53071 and 2 more.