Skip to main content

Linux Kernel EUVDEUVD-2026-38939

| CVE-2026-53071 HIGH
Missing Lock Check (CWE-414)
2026-06-24 Linux GHSA-g7cw-xhg8-933g
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain Bluetooth LE proximity to target
  2. Delivery
    Establish/abuse LE L2CAP ECRED channel
  3. Exploit
    Send crafted ECRED reconfiguration response
  4. Execution
    Trigger unlocked l2cap_chan_del race
  5. Persist
    Corrupt channel list during concurrent iteration
  6. Impact
    Kernel memory corruption / panic (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-414
Exploitation Conditions

Exploitation requires Bluetooth Low Energy radio proximity to the target (AV:A) and that the target has the Bluetooth subsystem active with an established LE L2CAP connection-oriented channel in Enhanced Credit Based (ECRED) flow-control mode - the attacker must be a connected/paired BLE peer able to emit an L2CAP ECRED reconfiguration response. No authentication beyond the BLE link is needed (PR:N) and no user interaction (UI:N). Limiting factors that reduce real-world risk: the attacker must be in radio range, the host must have Bluetooth enabled and be using LE ECRED channels (not all deployments do), and success depends on winning a race against a concurrently iterating thread, so reliable exploitation requires hitting a narrow timing window rather than a deterministic single packet.
Impact

Signals are mixed and should temper the headline 8.8. The vendor CVSS vector (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H) treats this as a low-complexity adjacent attack with full CIA impact, but the root cause is a race condition that requires winning a timing window against a concurrently iterating thread - realistically AC:H, which the vector understates. Attack vector is Adjacent (Bluetooth radio range), not Internet-routable, so exposure is limited to attackers in BLE proximity of a Bluetooth-enabled, BLE-connected host. EPSS is very low (0.16%/6th percentile), there is no KEV listing and no public exploit identified, consistent with a hard-to-weaponize kernel race rather than a mass-exploited bug. The most reliable real-world outcome is a kernel panic (DoS); memory-corruption-to-code-execution is theoretically possible but unproven and difficult to achieve remotely via a race. Note a data conflict: the input tags label this 'Information Disclosure,' yet the mechanism (list corruption / UAF) is more naturally a memory-safety/DoS issue - the info-disclosure framing is not corroborated by the description and should be verified. Net: a legitimate kernel memory-safety bug worth patching, but lower practical priority than the 8.8 alone implies given adjacency, race complexity, and absence of exploitation evidence.
Exploit ScenarioDerived

An attacker within Bluetooth range of a victim that has an active LE L2CAP ECRED channel sends a crafted L2CAP ECRED reconfiguration response. The malicious response drives l2cap_ecred_reconf_rsp() to delete a channel without the channel lock while another kernel thread is iterating the channel list, corrupting kernel memory and most likely panicking the host (denial of service), with a theoretical path to further memory corruption. No public proof-of-concept has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Race-condition memory corruption in the Linux kernel Bluetooth L2CAP stack lets a nearby BLE device crash or potentially compromise an affected host. The l2cap_ecred_reconf_rsp() handler calls l2cap_chan_del() without first taking l2cap_chan_lock(), so a crafted L2CAP Enhanced Credit (ECRED) reconfiguration response can mutate the channel list while another kernel thread iterates it. The flaw carries a vendor CVSS of 8.8 but a very low EPSS (0.16%, 6th percentile), is not in CISA KEV, and no public exploit has been identified at time of analysis; a vendor patch is available.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later in each series), or apply your distribution's backport referencing the kernel.org stable commits (https://git.kernel.org/stable/c/96dca51715d86559ed6ed8028e5445cecb80f3ae and the other listed hashes). The fix simply adds l2cap_chan_hold()/l2cap_chan_lock() before and l2cap_chan_unlock()/l2cap_chan_put() after the l2cap_chan_del() call in l2cap_ecred_reconf_rsp(). Where immediate patching is not possible, the practical compensating control is to remove the attack surface: unload or blacklist the Bluetooth/BLE stack (e.g. disable the bluetooth service and rmmod/blacklist the btusb and bluetooth modules) on systems that do not need it, which fully eliminates exposure at the cost of losing all Bluetooth functionality. On systems that need Bluetooth, keep the radio powered off when unused and avoid pairing/connecting to untrusted LE devices to reduce the window in which a malicious peer can send ECRED reconfiguration responses; this reduces but does not eliminate risk. Track advisories via the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-53071).

Affected VersionsENISA

Linux 15f02b91056253e8cdc592888f431da0731337b8 <fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14
Linux 15f02b91056253e8cdc592888f431da0731337b8 <330b20ec97916961ee0e6c29c06bc0fa7c96e64c
Linux patch: 5.10.258
Linux patch: 5.15.209
Linux 15f02b91056253e8cdc592888f431da0731337b8 <96dca51715d86559ed6ed8028e5445cecb80f3ae
Linux patch: 6.1.175
Linux 15f02b91056253e8cdc592888f431da0731337b8 <0ccd75c51f620374086f359e906917676e699a1c
Linux 5.7
Linux patch: 6.12.91
Linux 15f02b91056253e8cdc592888f431da0731337b8 <77a853aec710b2fdf41fa298ea3cbc9a4358f917
Linux 15f02b91056253e8cdc592888f431da0731337b8 <5501d055a1ce3c747141e3955ba8cf034d193f3e
Linux 15f02b91056253e8cdc592888f431da0731337b8 <dc89961b76f12aff47124c1df4bdb32a080f4d0c
Linux patch: 6.6.141
Linux patch: 6.18.33
Linux 15f02b91056253e8cdc592888f431da0731337b8 <42776497cdbc9a665b384a6dcb85f0d4bd927eab
Linux patch: 7.1
Linux patch: 7.0.10
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability lives in the Bluetooth Low Energy L2CAP implementation (net/bluetooth/l2cap_core.c). L2CAP's Enhanced Credit Based Flow Control (ECRED) mode, introduced for LE connection-oriented channels, processes reconfiguration responses in l2cap_ecred_reconf_rsp(). Channel teardown via l2cap_chan_del() must be serialized by the per-channel mutex l2cap_chan_lock() and protected by a reference via l2cap_chan_hold()/l2cap_chan_put(); every other caller in the file (e.g. l2cap_ecred_conn_rsp() and l2cap_conn_del()) follows this pattern, but the reconf-response path omitted it. The result is a classic concurrency defect - CWE-362 (race condition) leading to CWE-416 (use-after-free) / list corruption - where one thread frees or unlinks a channel object while another walks the list, corrupting kernel memory. The CPE data identifies the affected product generically as cpe:2.3:a:linux:linux:*, i.e. the upstream Linux kernel, with the bug present since the ECRED code was added (around v5.7).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.4 MEDIUM

Bluetooth proximity (AV:A) and unauthenticated link (PR:N), but winning the race window raises AC:H; primary impact is kernel panic (A:H) with limited, unproven memory disclosure/corruption (C:L/I:L).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 7.1 HIGH
AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it.

Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().

Executive ViewAI

Why It Matters

A race condition in the Linux kernel Bluetooth L2CAP stack (CVE-2026-53071, CVSS 8.8) allows a nearby Bluetooth device to cause denial of service or potentially execute code on affected hosts. However, the vulnerability carries an exceptionally low exploitation likelihood (0.2% EPSS, 6th percentile), no public exploit has been identified, and a vendor patch is available, significantly reducing organizational risk.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel runs everywhere, though only Bluetooth-LE-enabled hosts are exposed
Vendor Action
See Below
Not affected (vendor confirmed)
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Controlled
Automatable· derived
No
Human Impact
Medium

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-414 – Missing Lock Check

View all
CVE-2025-54510 MEDIUM
5.9
CVE-2026-54906 LOW
2.1
CVE-2025-54625 MEDIUM
6.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.149 Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.296 Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.570 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53071 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373383 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22511/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22512/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22521/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22522/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22665/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22666/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22699/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2799/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2800/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2840/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2841/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3044/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3089/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3156/ REF https://access.redhat.com/errata/RHSA-2026:42550 REF https://access.redhat.com/errata/RHSA-2026:42552 REF https://access.redhat.com/errata/RHSA-2026:42919 REF https://access.redhat.com/errata/RHSA-2026:43307 REF https://access.redhat.com/errata/RHSA-2026:65710 REF https://access.redhat.com/errata/RHSA-2026:65711 REF https://access.redhat.com/errata/RHSA-2026:67721 REF https://access.redhat.com/errata/RHSA-2026:67723 REF https://access.redhat.com/security/cve/CVE-2026-53071 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492458 REF https://git.kernel.org/stable/c/0ccd75c51f620374086f359e906917676e699a1c REF https://git.kernel.org/stable/c/330b20ec97916961ee0e6c29c06bc0fa7c96e64c REF https://git.kernel.org/stable/c/42776497cdbc9a665b384a6dcb85f0d4bd927eab REF https://git.kernel.org/stable/c/5501d055a1ce3c747141e3955ba8cf034d193f3e REF https://git.kernel.org/stable/c/77a853aec710b2fdf41fa298ea3cbc9a4358f917 REF https://git.kernel.org/stable/c/96dca51715d86559ed6ed8028e5445cecb80f3ae REF https://git.kernel.org/stable/c/dc89961b76f12aff47124c1df4bdb32a080f4d0c REF https://git.kernel.org/stable/c/fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53071.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy