CVE-2026-23461: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23461 is a use-after-free vulnerability in the Linux kernel's Bluetooth L2CAP subsystem, specifically in the l2cap_unregister_user() and l2cap_register_user() functions. The flaw was introduced after commit ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del"), which caused l2cap_conn_del() to use conn->lock for protecting conn->users, while the registration/unregistration functions continued using hci_dev_lock(), creating an inconsistent locking scheme. Affected versions include Linux kernel 6.6.84–6.6.129, 6.12.20–6.12.77, 6.13.8–6.13.x, 6.14.x (including release candidates), 6.18.x–6.18.19, 6.19.x–6.19.9, and 7.0 release candidates. The vulnerability was disclosed on April 3, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is a race condition (CWE-416: Use After Free) arising from inconsistent mutex usage in the Linux kernel Bluetooth L2CAP subsystem. After l2cap_conn_del() was updated to protect conn->users and conn->hchan with conn->lock, the l2cap_register_user() and l2cap_unregister_user() functions were not updated accordingly and continued using hci_dev_lock(). This allows concurrent access to the l2cap_conn structure — specifically conn->users and conn->hchan — between the registration/unregistration functions and l2cap_conn_del(), leading to use-after-free and list corruption. The attack vector is adjacent network (Bluetooth range), requires no privileges and no user interaction, and was originally reported by syzbot (Google's kernel fuzzer) (GitHub Advisory, Feedly).

Successful exploitation of this race condition can result in kernel memory corruption, system crashes (denial of service), or potentially arbitrary code execution in kernel context on Bluetooth-enabled Linux systems. All three security dimensions are affected: confidentiality (kernel memory disclosure), integrity (memory corruption), and availability (kernel panic/crash). Because exploitation occurs at the kernel level, a successful attack could grant an attacker full control of the affected system, with potential for lateral movement within a network (GitHub Advisory, Feedly).

Patches are available in the following Linux kernel stable releases: 6.6.130, 6.12.78, 6.18.20, 6.19.10, and 7.0-rc5 or later. The fix changes l2cap_register_user() and l2cap_unregister_user() to use conn->lock instead of hci_dev_lock(), ensuring consistent locking. Reference patch commits include 11a87dd5df42, c22a5e659959, da3000cbe485, 71030f3b3015, and 752a6c9596dd. As a temporary workaround where patching is not immediately feasible, administrators should consider disabling Bluetooth on affected systems or restricting Bluetooth access to trusted environments only. SUSE has also released updated kernel packages addressing this vulnerability (GitHub Advisory, SUSE Advisory).

The vulnerability was initially reported by syzbot, Google's automated kernel fuzzing infrastructure, which identified the use-after-free and list corruption bugs in the Bluetooth L2CAP subsystem. SUSE issued multiple security update announcements addressing this CVE across their kernel packages. The Yocto Project security mailing list also tracked and discussed the issue. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vendor patch tracking (SUSE Advisory, Feedly).