Linux Kernel EUVD-2026-45748

The flaw lives in the kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation, specifically the l2cap_ecred_conn_rsp() handler that processes responses for Enhanced Credit-Based flow-control mode channels used by LE Connection-Oriented Channels. The Bluetooth spec dictates that if a destination CID (dcid) is received for an already-assigned CID, both channels must be discarded. The buggy code called l2cap_chan_del() from within a list_for_each_entry_safe() loop, which can invalidate the 'tmp' iterator cursor, leading to list corruption / use-after-free style behavior; it was also the wrong teardown procedure since a previously-assigned chan->dcid actually needs a full disconnect. The fix schedules l2cap_chan_timeout() with a zero delay to close the channel asynchronously, avoiding cursor invalidation. Root-cause class is unsafe list iteration during element removal (an iterator-invalidation / use-after-free bug); the CWE field was not populated (N/A) in the source data. The affected code is generic kernel code (cpe:2.3:a:linux:linux:*), not tied to a single distribution.