A flaw in the Linux kernel’s Bluetooth L2CAP subsystem causes a deadlock during socket teardown. The l2cap_conn_del() routine acquires the connection lock and then cancels pending receive work while still holding the same lock. The worker function process_pending_rx() also locks that mutex, producing a circular lock dependency. When the deadlock occurs the kernel can hang, resulting in a system‑wide denial of service.

This defect affects all Linux kernel binaries that include the buggy L2CAP code. The affected kernel releases explicitly listed in the CPE data are 3.16 and its release candidates rc3 through rc7, as well as 7.2 release candidates rc1 and rc2. All older kernels or builds prior to the patch that reorders cancellation of pending_rx_work accordingly remain vulnerable.

The CVSS score of 8.8 conveys high severity, while the EPSS score of <1% indicates a low probability of exploitation in the wild. The vulnerability is not yet catalogued in CISA’s KEV list. Exploitation requires a local user or an attacker with the ability to create and destroy Bluetooth L2CAP sockets, which can be performed by standard socket APIs. By repeatedly initiating teardown operations the attacker can induce the kernel to deadlock and cause a system hang. The attack is inferred to be local; remote exploitation would depend on Bluetooth service exposure.