The Linux kernel's Bluetooth L2CAP subsystem contained a use-after-free vulnerability (CVE-2026-23461) caused by inconsistent locking mechanisms. After a prior commit introduced conn->lock to protect access to conn->users, the functions l2cap_register_user() and l2cap_unregister_user() did not adopt this lock, instead using hci_dev_lock(), creating a race condition. This allowed concurrent access to conn->users and conn->hchan alongside l2cap_conn_del(), potentially leading to use-after-free and list corruption bugs. The fix involved modifying l2cap_register_user() and l2cap_unregister_user() to use conn->lock, ensuring consistent locking and preventing the race condition. This vulnerability affects linux-hwe-edge kernel versions prior to various 6.8.x builds as listed. Official Ubuntu advisories confirm the availability of patches and recommend system updates and reboots.

Successful exploitation of this vulnerability could lead to use-after-free conditions and list corruption in the Bluetooth L2CAP subsystem, potentially allowing an attacker to cause memory corruption. The CVSS 3.1 vector indicates the attack requires adjacent network access, no privileges, and no user interaction, with high impact on confidentiality, integrity, and availability. This could result in system compromise or denial of service.

A patch addressing this vulnerability is available and has been released in official Ubuntu security updates for linux-hwe-edge kernel packages. Users should apply the updates corresponding to their Ubuntu release and reboot their systems to ensure the fix is applied. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow vendor instructions for updating and rebuilding kernel modules as needed.