The Linux kernel Bluetooth L2CAP subsystem had a deadlock vulnerability (CVE-2026-64206) caused by improper ordering of lock acquisition and work cancellation. Specifically, l2cap_conn_del() took the conn->lock mutex before calling cancel_work_sync() on pending_rx_work, while process_pending_rx() also took the same mutex. This created a circular locking dependency that could cause a deadlock during connection teardown. The vulnerability was identified by static analysis and confirmed with a proof-of-concept demonstrating the deadlock. The resolution was to cancel the pending_rx_work before acquiring conn->lock, aligning with the existing lock-before-drain ordering for other delayed works in the teardown path.

This vulnerability can cause a deadlock in the Bluetooth L2CAP connection teardown process, potentially leading to resource hangs or denial of service on affected systems running the vulnerable Linux kernel versions. There is no indication of code execution or privilege escalation from this issue.

A fix has been implemented in the Linux kernel to cancel the pending_rx_work before taking the conn->lock, preventing the deadlock. Users should update their Linux kernel to a version that includes this fix. Since no vendor advisory or patch links are provided, check the official Linux kernel repositories or distributions for the relevant patch or updated kernel version. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.