← Back to CVE Explorer

CVE-2026-23461

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user After commit ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del"), l2cap_conn_del() uses conn->lock to protect access to conn->users. However, l2cap_register_user() and l2cap_unregister_user() don't use conn->lock, creating a race condition where these functions can access conn->users and conn->hchan concurrently with l2cap_conn_del(). This can lead to use-after-free and list corruption bugs, as reported by syzbot. Fix this by changing l2cap_register_user() and l2cap_unregister_user() to use conn->lock instead of hci_dev_lock(), ensuring consistent locking for the l2cap_conn structure.

Severity
HIGH
CVSS score
8.8 (v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-04-03 16:16:33.140000
Last modified
2026-10-19 19:17:50.107000
View original CVE JSON 
{
  "id": "CVE-2026-23461",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-04-03T16:16:33.140",
  "lastModified": "2026-10-19T19:17:50.107",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user\n\nAfter commit ab4eedb790ca (\"Bluetooth: L2CAP: Fix corrupted list in\nhci_chan_del\"), l2cap_conn_del() uses conn->lock to protect access to\nconn->users. However, l2cap_register_user() and l2cap_unregister_user()\ndon't use conn->lock, creating a race condition where these functions can\naccess conn->users and conn->hchan concurrently with l2cap_conn_del().\n\nThis can lead to use-after-free and list corruption bugs, as reported\nby syzbot.\n\nFix this by changing l2cap_register_user() and l2cap_unregister_user()\nto use conn->lock instead of hci_dev_lock(), ensuring consistent locking\nfor the l2cap_conn structure."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: L2CAP: Corrección de uso después de liberación en l2cap_unregister_user\n\nDespués del commit ab4eedb790ca ('Bluetooth: L2CAP: Corrección de lista corrupta en hci_chan_del'), l2cap_conn_del() utiliza conn -> lock para proteger el acceso a conn -> users. Sin embargo, l2cap_register_user() y l2cap_unregister_user() no utilizan conn -> lock, creando una condición de carrera donde estas funciones pueden acceder a conn -> users y conn -> hchan concurrentemente con l2cap_conn_del().\n\nEsto puede llevar a uso después de liberación y errores de corrupción de lista, según lo informado por syzbot.\n\nEsto se corrige cambiando l2cap_register_user() y l2cap_unregister_user() para que utilicen conn -> lock en lugar de hci_dev_lock(), asegurando un bloqueo consistente para la estructura l2cap_conn."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "efc30877bd4bc85fefe98d80af60fafc86e5775e",
              "lessThan": "11a87dd5df428a4b79a84d2790cac7f3c73f1f0d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "f87271d21dd4ee83857ca11b94e7b4952749bbae",
              "lessThan": "c22a5e659959eb77c2fbb58a5adfaf3c3dab7abf",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ab4eedb790cae44313759b50fe47da285e2519d5",
              "lessThan": "da3000cbe4851458a22be38bb18c0689c39fdd5f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ab4eedb790cae44313759b50fe47da285e2519d5",
              "lessThan": "71030f3b3015a412133a805ff47970cdcf30c2b8",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ab4eedb790cae44313759b50fe47da285e2519d5",
              "lessThan": "752a6c9596dd25efd6978a73ff21f3b592668f4a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "18ab6b6078fa8191ca30a3065d57bf35d5635761",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6.6.84",
              "lessThan": "6.6.130",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.12.20",
              "lessThan": "6.12.78",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.13.8",
              "lessThan": "6.14",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.14",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.14",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.130",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.78",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.20",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.19.10",
              "lessThanOrEqual": "6.19.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.0",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-16T15:08:32.316331Z",
          "id": "CVE-2026-23461",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.6.84",
              "versionEndExcluding": "6.6.130",
              "matchCriteriaId": "A87F64C1-AF3B-48DC-89AD-A8C7069BFBA8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.12.20",
              "versionEndExcluding": "6.12.78",
              "matchCriteriaId": "EDA52060-BD07-4881-B1B9-27DD1F069333"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.13.8",
              "versionEndExcluding": "6.14",
              "matchCriteriaId": "366CEEDE-ED7E-4CD5-A00F-927D6C249DFD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.14.1",
              "versionEndExcluding": "6.18.20",
              "matchCriteriaId": "BD54E28E-E5DD-4B1B-9B3C-D90CA91313C7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.19",
              "versionEndExcluding": "6.19.10",
              "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*",
              "matchCriteriaId": "7DE421BA-0600-4401-A175-73CAB6A6FB4E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "66619FB8-0AAF-4166-B2CF-67B24143261D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "D3D6550E-6679-4560-902D-AF52DCFE905B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "45B90F6B-BEC7-4D4E-883A-9DBADE021750"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "1759FFB7-531C-41B1-9AE1-FD3D80E0D920"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "AD948719-8628-4421-A340-1066314BBD4A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/11a87dd5df428a4b79a84d2790cac7f3c73f1f0d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/71030f3b3015a412133a805ff47970cdcf30c2b8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/752a6c9596dd25efd6978a73ff21f3b592668f4a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/c22a5e659959eb77c2fbb58a5adfaf3c3dab7abf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/da3000cbe4851458a22be38bb18c0689c39fdd5f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}