0.0
NA
CVE-2026-31499
Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() l2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer and id_addr_timer while holding conn->lock. However, the work functions l2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire conn->lock, creating a potential AB-BA deadlock if the work is already executing when l2cap_conn_del() takes the lock. Move the work cancellations before acquiring conn->lock and use disable_delayed_work_sync() to additionally prevent the works from being rearmed after cancellation, consistent with the pattern used in hci_conn_del().

INFO

Published Date :

April 22, 2026, 2:16 p.m.

Last Modified :

April 22, 2026, 2:16 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-31499 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

Solution
Address potential AB-BA deadlock in Bluetooth L2CAP by moving work cancellations.
  • Move work cancellations before acquiring conn->lock.
  • Use disable_delayed_work_sync() for work functions.
  • Apply the fix for Bluetooth L2CAP concurrency issues.
  • Update the Linux kernel to the latest version.
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-31499.

URL Resource
https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608
https://git.kernel.org/stable/c/3f26ecbd9cde621dd94be7ef252c7210b965a5c7
https://git.kernel.org/stable/c/d008460de352e534f6721de829b093368564ec66
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-31499 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-31499 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-31499 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-31499 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Apr. 22, 2026

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() l2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer and id_addr_timer while holding conn->lock. However, the work functions l2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire conn->lock, creating a potential AB-BA deadlock if the work is already executing when l2cap_conn_del() takes the lock. Move the work cancellations before acquiring conn->lock and use disable_delayed_work_sync() to additionally prevent the works from being rearmed after cancellation, consistent with the pattern used in hci_conn_del().
    Added Reference https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608
    Added Reference https://git.kernel.org/stable/c/3f26ecbd9cde621dd94be7ef252c7210b965a5c7
    Added Reference https://git.kernel.org/stable/c/d008460de352e534f6721de829b093368564ec66
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.