CVE-2026-53071

Name	CVE-2026-53071
Description	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4664-1, DLA-4665-1, DLA-4671-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	bullseye	5.10.223-1	vulnerable
	bullseye (security)	5.10.259-1	fixed
	bookworm, bookworm (security)	6.1.176-1	fixed
	trixie	6.12.94-1	fixed
	trixie (security)	6.12.95-1	fixed
	forky, sid	7.1.3-1	fixed
linux-6.1 (PTS)	bullseye (security)	6.1.176-1~deb11u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
linux	source	bullseye	5.10.259-1	DLA-4664-1
linux	source	bookworm	6.1.176-1	DLA-4665-1
linux	source	trixie	6.12.94-1
linux	source	(unstable)	7.0.10-1
linux-6.1	source	bullseye	6.1.176-1~deb11u1	DLA-4671-1

https://git.kernel.org/linus/42776497cdbc9a665b384a6dcb85f0d4bd927eab (7.1-rc1)