CVE-2026-53357

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Bluetooth L2CAP socket cleanup process. The problem occurs during a race condition between l2cap sock cleanup listen() and l2cap conn del(). Specifically, bt accept dequeue() unlinks a child socket from the parent accept queue and releases it before returning, leaving the socket without a caller reference and unlocked. If a concurrent HCI disconnect triggers l2cap conn del(), it can free the child socket and its l2cap chan while l2cap sock cleanup listen() is still attempting to use them. This can lead to a system crash or memory corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.