CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-22 · updated 2026-06-17
Weakness: CWE-667

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() l2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer and id_addr_timer while holding conn->lock. However, the work functions l2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire conn->lock, creating a potential AB-BA deadlock if the work is already executing when l2cap_conn_del() takes the lock. Move the work cancellations before acquiring conn->lock and use disable_delayed_work_sync() to additionally prevent the works from being rearmed after cancellation, consistent with the pattern used in hci_conn_del().

Affected products

Linux kernel: from 6.6.84 before 6.7; from 6.12.20 before 6.13; from 6.13.8 before 6.14; from 6.14.1 before 6.18.21; from 6.19 before 6.19.11; 6.14, 7.0-rc1, 7.0-rc2, 7.0-rc3, 7.0-rc4, 7.0-rc5 (+2) — fixed in 6.13, 6.14, 6.18.21, 6.19.11, 6.7

How to fix

Upgrade to a fixed version: Linux kernel 6.13, 6.14, 6.18.21, 6.19.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-31499 or the next vulnerability affects your stack