BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

CVE-2026-23461

8.8 high SSVC exploitation: none Modified
NVD · CVE.org

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user After commit ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del"), l2cap_conn_del() uses conn->lock to protect access to conn->users. However, l2cap_register_user() and l2cap_unregister_user() don't use conn->lock, creating a race condition where these functions can access conn->users and conn->hchan concurrently with l2cap_conn_del(). This can lead to use-after-free and list corruption bugs, as reported by syzbot. Fix this by changing l2cap_register_user() and l2cap_unregister_user() to use conn->lock instead of hci_dev_lock(), ensuring consistent locking for the l2cap_conn structure.

Fix

Patch, vendor advisory and mitigation references on NVD 5

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 3

  1. CwesCWE-416 → CWE-416, CWE-362NVD modified 2026-10-19 19:17
  2. StatusAnalyzed → ModifiedNVD modified 2026-10-19 19:17
  3. First seenCVSS 8.8 · linuxNVD modified 2026-10-16 15:17

Affected (CPE criteria) 11

  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*

References 5