CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
Vulnerability summary
CVE-2026-53071 is a high (CVSS 8.8) Improper Locking vulnerability in linux. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 37.2% of scored vulnerabilities.
Not severe (CVSS 8.8, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 63 · Related 54Timeline
- 24-06-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.43% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-667Improper LockingThe product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
- CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Affected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu154 products
- linux< 5.15.0-186.196 | < 6.8.0-136.136 | All versions (No fix recorded) | < 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 5.15.0-1112.119 | < 6.8.0-1061.64 | All versions (No fix recorded) | < 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 15f02b91056253e8cdc592888f431da0731337b8, < 96dca51715d86559ed6ed8028e5445cecb80f3ae | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < 330b20ec97916961ee0e6c29c06bc0fa7c96e64c | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < 0ccd75c51f620374086f359e906917676e699a1c | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < 77a853aec710b2fdf41fa298ea3cbc9a4358f917 | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14 | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < dc89961b76f12aff47124c1df4bdb32a080f4d0c | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < 5501d055a1ce3c747141e3955ba8cf034d193f3e | ≥ 15f02b91056253e8cdc592888f431da0731337b8, < 42776497cdbc9a665b384a6dcb85f0d4bd927eab | 5.7
- linux_kernel≥ 5.7, < 5.10.258 | ≥ 5.11, < 5.15.209 | ≥ 5.16, < 6.1.175 | ≥ 6.2, < 6.6.141 | ≥ 6.7, < 6.12.91 | ≥ 6.13, < 6.18.33 | ≥ 6.19, < 7.0.10
Debian1 product
- linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.10-1
3 vendors · 157 products
References
61 linksShow all 61 references
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53071.jsonX Sadp Csaf VexThird Party Advisory
