CVE-2026-53358 Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
A race condition in the Linux kernel Bluetooth L2CAP subsystem can lead to a denial of service due to improper lock ordering during channel cleanup.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53358?
CVE-2026-53358 is a high-severity vulnerability in Linux kernel, published on 2 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
l2cap_chan_close() removes the channel from conn->chan_l, which must be done under conn->lock. cleanup_listen() runs under the parent sk_lock, so acquiring conn->lock would invert the established conn->lock -> chan->lock -> sk_lock order.
Instead of calling l2cap_chan_close() directly, schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously. The timeout handler already acquires conn->lock and chan->lock in the correct order.
The timer is only armed when chan->conn is still set: if it is already NULL, l2cap_conn_del() has already processed this channel (l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb), so there is nothing left to do. If l2cap_conn_del() races in after the timer is armed, __clear_chan_timer() inside l2cap_chan_del() cancels it; if the timer has already fired, the handler returns harmlessly because chan->conn was cleared.
Which versions are affected by CVE-2026-53358?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53358?
Apply the vendor's patch.
Is CVE-2026-53358 being exploited?
There is no known exploitation of CVE-2026-53358 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53358, DEBIAN-CVE-2026-53358, GHSA-g5v6-wm74-gh57, ROOT-OS-DEBIAN-11-CVE-2026-53358, ROOT-OS-DEBIAN-12-CVE-2026-53358, ROOT-OS-UBUNTU-2204-CVE-2026-53358 and 2 more.