Linux Kernel CVE-2026-53071

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later in each series), or apply your distribution's backport referencing the kernel.org stable commits (https://git.kernel.org/stable/c/96dca51715d86559ed6ed8028e5445cecb80f3ae and the other listed hashes). The fix simply adds l2cap_chan_hold()/l2cap_chan_lock() before and l2cap_chan_unlock()/l2cap_chan_put() after the l2cap_chan_del() call in l2cap_ecred_reconf_rsp(). Where immediate patching is not possible, the practical compensating control is to remove the attack surface: unload or blacklist the Bluetooth/BLE stack (e.g. disable the bluetooth service and rmmod/blacklist the btusb and bluetooth modules) on systems that do not need it, which fully eliminates exposure at the cost of losing all Bluetooth functionality. On systems that need Bluetooth, keep the radio powered off when unused and avoid pairing/connecting to untrusted LE devices to reduce the window in which a malicious peer can send ECRED reconfiguration responses; this reduces but does not eliminate risk. Track advisories via the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-53071).