CVE-2026-53071 - Vulnerability Details

- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file
acquires the lock first. A remote BLE device can send a crafted
L2CAP ECRED reconfiguration response to corrupt the channel list
while another thread is iterating it.

Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),
and l2cap_chan_unlock() and l2cap_chan_put() after, matching the
pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().

Published: 2026-06-24

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 96dca51715d86559ed6ed8028e5445cecb80f3ae
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 330b20ec97916961ee0e6c29c06bc0fa7c96e64c
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 0ccd75c51f620374086f359e906917676e699a1c
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 77a853aec710b2fdf41fa298ea3cbc9a4358f917
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< dc89961b76f12aff47124c1df4bdb32a080f4d0c
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 5501d055a1ce3c747141e3955ba8cf034d193f3e
`15f02b91056253e8cdc592888f431da0731337b8`	affected	< 42776497cdbc9a665b384a6dcb85f0d4bd927eab

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[15f02b91056253e8cdc592888f431da0731337b8,96dca51715d86559ed6ed8028e5445cecb80f3ae)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,330b20ec97916961ee0e6c29c06bc0fa7c96e64c)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,0ccd75c51f620374086f359e906917676e699a1c)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,77a853aec710b2fdf41fa298ea3cbc9a4358f917)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,dc89961b76f12aff47124c1df4bdb32a080f4d0c)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,5501d055a1ce3c747141e3955ba8cf034d193f3e)`	affected	code_commit	—
`[15f02b91056253e8cdc592888f431da0731337b8,42776497cdbc9a665b384a6dcb85f0d4bd927eab)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.141,6.7.0)`	unaffected	semver	—
`[6.12.91,6.13.0)`	unaffected	semver	—
`[6.18.33,6.19.0)`	unaffected	semver	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00247.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0ccd75c51f620374086f359e906917676e699a1c
https://git.kernel.org/stable/c/330b20ec97916961ee0e6c29c06bc0fa7c96e64c
https://git.kernel.org/stable/c/42776497cdbc9a665b384a6dcb85f0d4bd927eab
https://git.kernel.org/stable/c/5501d055a1ce3c747141e3955ba8cf034d193f3e
https://git.kernel.org/stable/c/77a853aec710b2fdf41fa298ea3cbc9a4358f917
https://git.kernel.org/stable/c/96dca51715d86559ed6ed8028e5445cecb80f3ae
https://git.kernel.org/stable/c/dc89961b76f12aff47124c1df4bdb32a080f4d0c
https://git.kernel.org/stable/c/fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14
https://lore.kernel.org/linux-cve-announce/2026062404-CVE-2026-53071-bdae@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53071
https://www.cve.org/CVERecord?id=CVE-2026-53071

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 26 Jun 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Fri, 26 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-414
References		https://lore.kernel.org/linux-cve-announce/2026062404-CVE-2026-53071-bdae@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53071 https://www.cve.org/CVERecord?id=CVE-2026-53071
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Wed, 24 Jun 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Wed, 24 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
Title		Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0ccd75c51f620374086f359e906917676e699a1c https://git.kernel.org/stable/c/330b20ec97916961ee0e6c29c06bc0fa7c96e64c https://git.kernel.org/stable/c/42776497cdbc9a665b384a6dcb85f0d4bd927eab https://git.kernel.org/stable/c/5501d055a1ce3c747141e3955ba8cf034d193f3e https://git.kernel.org/stable/c/77a853aec710b2fdf41fa298ea3cbc9a4358f917 https://git.kernel.org/stable/c/96dca51715d86559ed6ed8028e5445cecb80f3ae https://git.kernel.org/stable/c/dc89961b76f12aff47124c1df4bdb32a080f4d0c https://git.kernel.org/stable/c/fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:30:12.694Z

Updated: 2026-06-28T06:38:56.987Z

Reserved: 2026-06-09T07:44:35.382Z

Link: CVE-2026-53071

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-53071 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T14:30:07Z

Weaknesses

CWE-414

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object