CVE-2026-53357 is a use-after-free vulnerability in the Linux kernel Bluetooth code, specifically involving the l2cap_sock_cleanup_listen() and l2cap_conn_del() functions. The root cause is a race condition where bt_accept_dequeue() releases a socket without a caller reference, and concurrent HCI disconnect processing frees the socket and its associated channel. Subsequent cleanup attempts use these freed objects, triggering a kernel slab-use-after-free error detected by KASAN. Previous fixes addressed related race conditions but did not cover this specific concurrency scenario. The fix involves taking a reference on the socket before releasing it and carefully managing locks to prevent use-after-free during concurrent socket and channel cleanup.

Successful exploitation could lead to use-after-free conditions in kernel memory, potentially causing system crashes or allowing an attacker with limited privileges to execute arbitrary code or escalate privileges. The CVSS vector indicates high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid unprivileged concurrent operations involving Bluetooth listening sockets and HCI disconnects. Monitor vendor channels for updates and apply patches promptly once released.