CVE-2026-53357: Linux Kernel Bluetooth L2CAP Use-After-Free Vulnerability

Technical summary

CVE-2026-53357 is a use-after-free (UAF) vulnerability in l2cap_sock_cleanup_listen() that races with l2cap_conn_del() in the Linux kernel Bluetooth subsystem. The vulnerability occurs when bt_accept_dequeue() returns a reference to a not-yet-accepted child socket without holding it, allowing concurrent HCI disconnect events to trigger l2cap_conn_del() → l2cap_chan_del() → l2cap_sock_kill(), which frees the child socket and its associated l2cap_chan structure. When cleanup_listen() subsequently accesses the freed socket during listening socket close, KASAN detects a slab-use-after-free condition. The fix adds a sock_hold() call in bt_accept_dequeue() before release_sock(), requiring callers to sock_put() and adds protective locking in cleanup_listen() using l2cap_chan_hold_unless_zero() to serialize access against l2cap_sock_teardown_cb().

Business impact

This vulnerability affects systems with Bluetooth capabilities where unprivileged local users can establish listening sockets. Exploitation could lead to kernel crashes (denial of service), system instability, or potential privilege escalation depending on the kernel's security posture. Organizations running Bluetooth-enabled Linux systems—including IoT devices, automotive systems, and desktop/laptop environments—face service disruption risk. The local-access requirement and need for Bluetooth connectivity limit exposure to direct remote attacks, but insider threats and compromised local processes present material risk.

Affected systems

The Linux kernel across multiple versions is affected, specifically the Bluetooth subsystem's L2CAP socket implementation. The vulnerability is present in the mainline kernel and affects any system running a vulnerable kernel version with Bluetooth support enabled. Verify the specific kernel versions addressed by consulting the Linux kernel security advisory and your distribution's patch status.

Exploitability

Exploitation requires local access to the system and the ability to create Bluetooth L2CAP listening sockets, typically available to unprivileged users. The race condition must be triggered by simultaneous socket operations and HCI disconnect events, making reliable exploitation non-trivial but reproducible under test conditions. According to the vulnerability description, the race was reproduced consistently (12 use-after-free instances per run) in controlled testing. This is not remotely exploitable and requires an attacker with local login capability or the ability to trigger Bluetooth connection state changes.

Remediation

Apply kernel patches that implement proper reference counting for child sockets in bt_accept_dequeue() and add serialization guards in l2cap_sock_cleanup_listen() using l2cap_chan_hold_unless_zero(). The fix ensures sockets are held while locked and released only after cleanup is complete, preventing the disconnect handler from freeing resources while cleanup_listen() is still accessing them. No configuration changes or workarounds are available; patching is the only remediation.

Patch guidance

Monitor your Linux distribution's security advisories for kernel updates addressing CVE-2026-53357. When patches become available, prioritize kernel updates for systems with Bluetooth enabled. Test patches in a non-production environment first to ensure compatibility with your specific Bluetooth hardware and configuration. Kernel updates typically require a reboot; plan maintenance windows accordingly. Verify patch application using your distribution's package verification tools and confirm the updated kernel includes the fixes described in the CVE resolution (sock_hold() in bt_accept_dequeue() and l2cap_chan_hold_unless_zero() in cleanup_listen()).

Detection guidance

System monitoring for kernel crashes and KASAN warnings (if running a kernel with AddressSanitizer enabled) may reveal exploitation attempts. Look for repeated kernel panics or oops messages referencing l2cap_sock_kill, l2cap_sock_cleanup_listen, or l2cap_conn_del in kernel logs. Bluetooth connection/disconnection events coinciding with application crashes involving listen sockets warrant investigation. Intrusion detection systems targeting local privilege escalation attempts may flag suspicious patterns of socket creation and Bluetooth device interaction, though this vulnerability's exploitation is unlikely to leave obvious audit trails without kernel-level monitoring.

Why prioritize this

This vulnerability merits high priority due to its HIGH CVSS score (8.0), local attack vector, and potential for both denial of service and privilege escalation. While it requires local access and Bluetooth interaction, many systems in modern deployments have these capabilities. The race condition reproducibility and kernel-level impact make it more serious than typical application crashes. Organizations should prioritize patching Linux systems with Bluetooth support, particularly those accessible to multiple local users or in multi-tenant environments.

Risk score, explained

The CVSS 3.1 score of 8.0 (HIGH) reflects a locally-exploitable vulnerability with no user interaction required, affecting the confidentiality, integrity, and availability of the system. The attack vector is local (AV:A—adjacent network, implying Bluetooth physical proximity or local system access) and privileges required are low (PR:L). The severity is driven by the potential for kernel crashes and the theoretical possibility of code execution through memory corruption, though controlled exploitation is non-trivial. The vulnerability does not require special network access or user interaction, justifying the elevated score.

Frequently asked questions