CVE-2026-53358

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()

l2cap_chan_close() removes the channel from conn->chan_l, which

must be done under conn->lock. cleanup_listen() runs under the

parent sk_lock, so acquiring conn->lock would invert the

established conn->lock -> chan->lock -> sk_lock order.

Instead of calling l2cap_chan_close() directly, schedule

l2cap_chan_timeout with delay 0 to close the channel

asynchronously. The timeout handler already acquires conn->lock

and chan->lock in the correct order.

The timer is only armed when chan->conn is still set: if it is

already NULL, l2cap_conn_del() has already processed this channel

(l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb),

so there is nothing left to do. If l2cap_conn_del() races in

after the timer is armed, __clear_chan_timer() inside

l2cap_chan_del() cancels it; if the timer has already fired, the

handler returns harmlessly bec

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References