{"id":"CVE-2026-64206","revision":"1c58c8872cfb400cb8c9e93342037e43","records":[{"revision":"1c58c8872cfb400cb8c9e93342037e43","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64206","aliases":[],"title":"Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: cancel pending_rx_work before taking conn->lock\n\nl2cap_conn_del() takes conn->lock and then calls cancel_work_sync() for\npending_rx_work.  process_pending_rx() takes the same mutex, so teardown\ncan deadlock against the worker it is flushing.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the l2cap_conn_ready() -> queue_work(...,\n&conn->pending_rx_work) submit path, the l2cap_conn_del() ->\ncancel_work_sync(&conn->pending_rx_work) teardown path, and the\nprocess_pending_rx() -> mutex_lock(&conn->lock) worker edge.  Lockdep\n\n  WARNING: possible circular locking dependency detected\n  process_pending_rx+0x21/0x2a [vuln_msv]\n  l2cap_conn_del.constprop.0+0x3f/0x4e [vuln_msv]\n  *** DEADLOCK ***\n\nCancel pending_rx_work before taking conn->lock, matching the existing\nlock-before-drain ordering used for the two delayed works in the same\nteardown path.  The pending_rx queue is still purged after the work has\nbeen cancelled and conn->lock has been acquired.","state":0,"publishedAt":"2026-07-20T16:27:53.885+00:00","modifiedAt":"2026-10-19T20:28:15.233+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/l2cap_core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7ab56c3a6eccb215034b0cb096e0313441cbf2a4\",\n                            \"lessThan\": \"fc0c3b9cf27cfa2a06f66dae1d08c668fe0a2faa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7ab56c3a6eccb215034b0cb096e0313441cbf2a4\",\n                            \"lessThan\": \"9901f847a762a5d953871dd95767ce2aed3d684d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7ab56c3a6eccb215034b0cb096e0313441cbf2a4\",\n                            \"lessThan\": \"4a0bb0fd63fe2b0c62e1072cd1811d6f61e0081c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7ab56c3a6eccb215034b0cb096e0313441cbf2a4\",\n                            \"lessThan\": \"8daaf7f73fe998631a160d1a5a7e1b0b0480eef8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7ab56c3a6eccb215034b0cb096e0313441cbf2a4\",\n                            \"lessThan\": \"8de7b386ffad480ca59222b688c94a2da8f0d805\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7ab56c3a6eccb215034b0cb096e0313441cbf2a4\",\n                            \"lessThan\": \"d5616beb3355b5fca2280d796c1cf7ada4ee6551\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7ab56c3a6eccb215034b0cb096e0313441cbf2a4\",\n                            \"lessThan\": \"e96fbac8d3a73b0bc165383c092a30628561d320\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7ab56c3a6eccb215034b0cb096e0313441cbf2a4\",\n                            \"lessThan\": \"2641a9e0a1dd4af2e21995470a21d55dd35e5203\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee805f9499ebd0edf0877990968543c752043b59\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3.15.5\",\n                            \"lessThan\": \"3.16\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/l2cap_core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.261\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.97\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.39\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.4\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/fc0c3b9cf27cfa2a06f66dae1d08c668fe0a2faa","https://git.kernel.org/stable/c/9901f847a762a5d953871dd95767ce2aed3d684d","https://git.kernel.org/stable/c/4a0bb0fd63fe2b0c62e1072cd1811d6f61e0081c","https://git.kernel.org/stable/c/8daaf7f73fe998631a160d1a5a7e1b0b0480eef8","https://git.kernel.org/stable/c/8de7b386ffad480ca59222b688c94a2da8f0d805","https://git.kernel.org/stable/c/d5616beb3355b5fca2280d796c1cf7ada4ee6551","https://git.kernel.org/stable/c/e96fbac8d3a73b0bc165383c092a30628561d320","https://git.kernel.org/stable/c/2641a9e0a1dd4af2e21995470a21d55dd35e5203"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64206","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64206","identifiers":["CVE-2026-64206"]},"retained":false,"historicalAffected":[]}],"coverage":[]}