The Linux kernel Bluetooth L2CAP subsystem had a vulnerability in the cleanup_listen() function where l2cap_chan_close() was called directly, violating the established lock acquisition order (conn->lock -> chan->lock -> sk_lock). This could lead to concurrency problems. The fix replaces the direct call with scheduling l2cap_chan_timeout with zero delay, which asynchronously closes the channel while acquiring locks in the correct order. The timer is only armed if the channel connection is still valid, and race conditions with channel deletion are safely handled by canceling or harmlessly returning from the timeout handler.

The vulnerability could cause concurrency issues in Bluetooth channel cleanup due to improper lock ordering, potentially leading to kernel instability or crashes. No known exploits are reported in the wild. The fix prevents these concurrency issues by enforcing correct lock acquisition order during channel closure.

A fix has been implemented in the Linux kernel to address this issue by changing the channel closure mechanism to use an asynchronous timer callback that respects lock ordering. Users should update to the fixed Linux kernel version once available. Patch status is not explicitly stated; check the vendor advisory for current remediation guidance.