CVE-2026-53358 - Vulnerability Details

- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()

l2cap_chan_close() removes the channel from conn->chan_l, which
must be done under conn->lock. cleanup_listen() runs under the
parent sk_lock, so acquiring conn->lock would invert the
established conn->lock -> chan->lock -> sk_lock order.

Instead of calling l2cap_chan_close() directly, schedule
l2cap_chan_timeout with delay 0 to close the channel
asynchronously. The timeout handler already acquires conn->lock
and chan->lock in the correct order.

The timer is only armed when chan->conn is still set: if it is
already NULL, l2cap_conn_del() has already processed this channel
(l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb),
so there is nothing left to do. If l2cap_conn_del() races in
after the timer is armed, __clear_chan_timer() inside
l2cap_chan_del() cancels it; if the timer has already fired, the
handler returns harmlessly because chan->conn was cleared.

Published: 2026-07-02

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw arises from a reversed lock ordering in the Bluetooth L2CAP cleanup_listen function. While holding the parent socket lock, the code attempts to remove a channel with a different lock order, which can trigger a kernel deadlock. The resulting hang would disable Bluetooth services and could stall the of‑service. The incident is classified as CWE-413 and CWE-667, a classic lock‑ordering defect and a concurrency error that can lead to deadlocks.

Affected Systems

All Linux kernel releases that ship the legacy L2CAP cleanup_listen path are affected, as indicated by the broad Linux kernel CPE. Because the vulnerability description does not narrow the range, every current default L2CAP implementation is at risk until the patch is applied.

Risk and Exploitability

The EPSS score of less than 1% suggests that successful exploitation is unlikely, and the vulnerability is not listed in CISA’s KEV catalog. No explicit attack vector is disclosed; however, it is reasonable to infer that an attacker could trigger the flaw by manipulating the Bluetooth stack, such as by sending malformed L2CAP packets or initiating connections that exercise cleanup_listen. Given the high CVSS score of 8.8, the potential impact is significant, leading to service disruption and possible system destabilization.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3df91ea20e744344100b10ae69a17211fcf5b207`	affected	< 3634cbdc2eb414b69ffa752ddbe5e0458518e321
`3df91ea20e744344100b10ae69a17211fcf5b207`	affected	< e1c100e2d61bd8c718b7d91fe3e050780a9bf72d
`3df91ea20e744344100b10ae69a17211fcf5b207`	affected	< deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9
`3df91ea20e744344100b10ae69a17211fcf5b207`	affected	< 89dec92041717b027216e110599e4f6d6c921b79
`3df91ea20e744344100b10ae69a17211fcf5b207`	affected	< 50dfec218808b148ab4247b1858031b7a32015c5
`3df91ea20e744344100b10ae69a17211fcf5b207`	affected	< 859d3ace791ed878ae9ba5522c7844d960da8f88
`3df91ea20e744344100b10ae69a17211fcf5b207`	affected	< 7555fd885a0603f50e49a655850a1f2bd8a25398
`3df91ea20e744344100b10ae69a17211fcf5b207`	affected	< 8c8e620467a7b51562dbcefbd1f09f288d7d710d

Linux

affected

Version	Status	Constraints
`3.4`	affected	—
`0`	unaffected	< 3.4
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3df91ea20e744344100b10ae69a17211fcf5b207,3634cbdc2eb414b69ffa752ddbe5e0458518e321)`	affected	code_commit	—
`[3df91ea20e744344100b10ae69a17211fcf5b207,e1c100e2d61bd8c718b7d91fe3e050780a9bf72d)`	affected	code_commit	—
`[3df91ea20e744344100b10ae69a17211fcf5b207,deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9)`	affected	code_commit	—
`[3df91ea20e744344100b10ae69a17211fcf5b207,89dec92041717b027216e110599e4f6d6c921b79)`	affected	code_commit	—
`[3df91ea20e744344100b10ae69a17211fcf5b207,50dfec218808b148ab4247b1858031b7a32015c5)`	affected	code_commit	—
`[3df91ea20e744344100b10ae69a17211fcf5b207,859d3ace791ed878ae9ba5522c7844d960da8f88)`	affected	code_commit	—
`[3df91ea20e744344100b10ae69a17211fcf5b207,7555fd885a0603f50e49a655850a1f2bd8a25398)`	affected	code_commit	—
`[3df91ea20e744344100b10ae69a17211fcf5b207,8c8e620467a7b51562dbcefbd1f09f288d7d710d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.4`	affected	generic	—
`[0,3.4)`	unaffected	generic	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that contains the fix for the L2CAP lock‑ordering defect (the patch replaces direct channel close with an asynchronous timer), thereby eliminating the deadlock risk.
If a kernel update cannot be performed immediately, disable all Bluetooth services or unload the l2cap module to prevent interaction with the vulnerable cleanup logic until the kernel patch is applied.
For custom or embedded kernels, apply the specific header and source code changes from the kernel commit that schedules l2cap_chan_timeout instead of calling l2cap_chan_close directly; verify that the lock order is now conn->lock -> chan->lock -> sk_lock.

Generated by OpenCVE AI on August 12, 2026 at 09:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8566-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8568-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00196.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3634cbdc2eb414b69ffa752ddbe5e0458518e321
https://git.kernel.org/stable/c/50dfec218808b148ab4247b1858031b7a32015c5
https://git.kernel.org/stable/c/7555fd885a0603f50e49a655850a1f2bd8a25398
https://git.kernel.org/stable/c/859d3ace791ed878ae9ba5522c7844d960da8f88
https://git.kernel.org/stable/c/89dec92041717b027216e110599e4f6d6c921b79
https://git.kernel.org/stable/c/8c8e620467a7b51562dbcefbd1f09f288d7d710d
https://git.kernel.org/stable/c/deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9
https://git.kernel.org/stable/c/e1c100e2d61bd8c718b7d91fe3e050780a9bf72d
https://lore.kernel.org/linux-cve-announce/2026070236-CVE-2026-53358-6f81@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53358
https://www.cve.org/CVERecord?id=CVE-2026-53358

History

Sat, 18 Jul 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 03 Jul 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-739

Fri, 03 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-413
References		https://lore.kernel.org/linux-cve-announce/2026070236-CVE-2026-53358-6f81@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53358 https://www.cve.org/CVERecord?id=CVE-2026-53358
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Thu, 02 Jul 2026 23:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-739

Thu, 02 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_chan_close() removes the channel from conn->chan_l, which must be done under conn->lock. cleanup_listen() runs under the parent sk_lock, so acquiring conn->lock would invert the established conn->lock -> chan->lock -> sk_lock order. Instead of calling l2cap_chan_close() directly, schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously. The timeout handler already acquires conn->lock and chan->lock in the correct order. The timer is only armed when chan->conn is still set: if it is already NULL, l2cap_conn_del() has already processed this channel (l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb), so there is nothing left to do. If l2cap_conn_del() races in after the timer is armed, __clear_chan_timer() inside l2cap_chan_del() cancels it; if the timer has already fired, the handler returns harmlessly because chan->conn was cleared.
Title		Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3634cbdc2eb414b69ffa752ddbe5e0458518e321 https://git.kernel.org/stable/c/50dfec218808b148ab4247b1858031b7a32015c5 https://git.kernel.org/stable/c/7555fd885a0603f50e49a655850a1f2bd8a25398 https://git.kernel.org/stable/c/859d3ace791ed878ae9ba5522c7844d960da8f88 https://git.kernel.org/stable/c/89dec92041717b027216e110599e4f6d6c921b79 https://git.kernel.org/stable/c/8c8e620467a7b51562dbcefbd1f09f288d7d710d https://git.kernel.org/stable/c/deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9 https://git.kernel.org/stable/c/e1c100e2d61bd8c718b7d91fe3e050780a9bf72d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-02T13:43:17.630Z

Updated: 2026-08-05T12:35:07.724Z

Reserved: 2026-06-09T07:44:35.400Z

Link: CVE-2026-53358

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-02T15:17:03.283

Modified: 2026-07-22T19:07:50.270

Link: CVE-2026-53358

Redhat

Severity : Moderate

Publid Date: 2026-07-02T00:00:00Z

Links: CVE-2026-53358 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-12T09:45:01Z

Weaknesses

CWE-413
Improper Resource Locking
CWE-667
Improper Locking

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object