Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().

Timeline

1. Jun 24, 2026, 4:30 PM UTCCVE published
2. Oct 16, 2026, 3:25 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 19, 2026, 7:47 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 15f02b91056253e8cdc592888f431da0731337b8 · fixed in 96dca51715d86559ed6ed8028e5445cecb80f3ae; From 15f02b91056253e8cdc592888f431da0731337b8 · fixed in 330b20ec97916961ee0e6c29c06bc0fa7c96e64c; From 15f02b91056253e8cdc592888f431da0731337b8 · fixed in 0ccd75c51f620374086f359e906917676e699a1c; From 15f02b91056253e8cdc592888f431da0731337b8 · fixed in 77a853aec710b2fdf41fa298ea3cbc9a4358f917; From 15f02b91056253e8cdc592888f431da0731337b8 · fixed in fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14; From 15f02b91056253e8cdc592888f431da0731337b8 · fixed in dc89961b76f12aff47124c1df4bdb32a080f4d0c; From 15f02b91056253e8cdc592888f431da0731337b8 · fixed in 5501d055a1ce3c747141e3955ba8cf034d193f3e; From 15f02b91056253e8cdc592888f431da0731337b8 · fixed in 42776497cdbc9a665b384a6dcb85f0d4bd927eab

• Linux Linux

  5.7

• KernelLinux

  From 5.7.0 · fixed in 5.10.258; From 5.11.0 · fixed in 5.15.209; From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.141; From 6.7.0 · fixed in 6.12.91; From 6.13.0 · fixed in 6.18.33; From 6.19.0 · fixed in 7.0.10

References 8