CVE-2026-64206: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64206 is a deadlock vulnerability in the Linux kernel's Bluetooth L2CAP subsystem, specifically in the connection teardown path. The flaw exists in l2cap_conn_del(), which acquires conn->lock before calling cancel_work_sync() for pending_rx_work, while the process_pending_rx() worker also attempts to acquire the same mutex — creating a circular lock dependency that can freeze the kernel. It was discovered via static analysis and disclosed on July 20, 2026. Affected versions include Linux kernel 3.15.5 up to (but not including) 3.16, and kernel 3.16 through versions prior to 6.18.39 and 7.1.4. The CVSS base score is currently listed as 0.0 with a medium severity estimate pending formal scoring (GitHub Advisory, Feedly).

The root cause is a lock ordering violation (related to CWE-667: Improper Locking) in the Linux kernel Bluetooth L2CAP subsystem. In l2cap_conn_del(), conn->lock is acquired first, and then cancel_work_sync(&conn->pending_rx_work) is called to flush the pending RX worker. However, process_pending_rx() — the worker being flushed — also calls mutex_lock(&conn->lock), creating a circular dependency: the teardown path holds the lock while waiting for the worker to finish, and the worker is blocked waiting for the same lock. The fix reorders operations so that cancel_work_sync() is called before acquiring conn->lock, consistent with the lock-before-drain ordering already used for other delayed works in the same teardown path. A grounded proof-of-concept was constructed to validate the deadlock via Lockdep, which emitted a *** DEADLOCK *** warning (GitHub Advisory).

Successful exploitation causes a kernel deadlock during Bluetooth L2CAP connection teardown, resulting in a denial of service — the affected system or Bluetooth subsystem freezes and becomes unresponsive. A local attacker with the ability to initiate or manipulate Bluetooth L2CAP connections can trigger this condition by forcing connection cleanup at the right moment. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss (GitHub Advisory, Feedly).

Apply the upstream Linux kernel patch that reorders lock acquisition in l2cap_conn_del() to call cancel_work_sync(&conn->pending_rx_work) before acquiring conn->lock. Fixed commits are available at d5616beb3355b5fca2280d796c1cf7ada4ee6551, e96fbac8d3a73b0bc165383c092a30628561d320, and 2641a9e0a1dd4af2e21995470a21d55dd35e5203 in the stable kernel tree. Patched stable releases include kernel 6.18.39, 7.1.4, and 7.2-rc3 or later. As a temporary workaround where patching is not immediately possible, disabling Bluetooth on affected systems will prevent the vulnerable code path from being triggered (GitHub Advisory, Feedly).