CVE-2026-23461

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user<br /> <br /> After commit ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in<br /> hci_chan_del"), l2cap_conn_del() uses conn-&gt;lock to protect access to<br /> conn-&gt;users. However, l2cap_register_user() and l2cap_unregister_user()<br /> don&amp;#39;t use conn-&gt;lock, creating a race condition where these functions can<br /> access conn-&gt;users and conn-&gt;hchan concurrently with l2cap_conn_del().<br /> <br /> This can lead to use-after-free and list corruption bugs, as reported<br /> by syzbot.<br /> <br /> Fix this by changing l2cap_register_user() and l2cap_unregister_user()<br /> to use conn-&gt;lock instead of hci_dev_lock(), ensuring consistent locking<br /> for the l2cap_conn structure.