Linux EUVD-2026-18722

The Linux kernel Bluetooth subsystem implements L2CAP (Logical Link Control and Adaptation Protocol) for reliable packet delivery over Bluetooth connections. The vulnerability exists in the connection management layer where user registration/unregistration callbacks interact with connection deletion. Following commit ab4eedb790ca, l2cap_conn_del() began using conn->lock to serialize access to the conn->users list; however, l2cap_register_user() and l2cap_unregister_user() continued using only hci_dev_lock(), a different and less granular locking mechanism. This inconsistency creates a classic race condition: one code path (connection deletion) holds conn->lock while traversing conn->users and freeing conn->hchan, while concurrent registration/unregistration calls access the same structures without acquiring conn->lock, leading to time-of-check-time-of-use (TOCTOU) bugs. The root cause is insufficient synchronization (CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization) combined with use-after-free (CWE-416). The fix unifies the locking strategy by requiring conn->lock in both registration paths, ensuring all access to conn->users and conn->hchan is serialized.