Bluetooth L2CAP Vulnerability in Linux Kernel by Linux Foundation

CVE-2026-31499

What is CVE-2026-31499?

The Linux kernel exhibits a vulnerability in its Bluetooth implementation, specifically within the L2CAP layer. The issue arises from the improper handling of connection locks in the function l2cap_conn_del(). When this function attempts to cancel delayed work items while holding the connection lock, it can lead to a classic deadlock scenario. This occurs if the work functions l2cap_info_timeout() and l2cap_conn_update_id_addr() attempt to acquire the same lock that l2cap_conn_del() holds, resulting in a potential AB-BA deadlock. To mitigate this issue, the cancellation of work items should occur before obtaining the lock, and the use of disable_delayed_work_sync() is recommended to prevent re-arming the works after cancellation.

References