CVE-2026-31499 is a deadlock vulnerability in the Linux kernel's Bluetooth L2CAP subsystem. The function l2cap_conn_del() calls cancel_delayed_work_sync() for info_timer and id_addr_timer while holding conn->lock. Meanwhile, the work functions l2cap_info_timeout() and l2cap_conn_update_id_addr() also acquire conn->lock, creating a potential AB-BA deadlock if the work is executing when l2cap_conn_del() takes the lock. The fix moves work cancellations before acquiring conn->lock and uses disable_delayed_work_sync() to prevent rearming after cancellation, aligning with patterns used elsewhere in the kernel. This resolves the deadlock and improves kernel stability.

The vulnerability can cause a deadlock in the Bluetooth L2CAP connection handling, potentially leading to system hangs or denial of service conditions. There is no impact on confidentiality or integrity. The CVSS score is 5.5 (medium severity) reflecting the availability impact without privilege escalation or data compromise. No known exploits are reported in the wild.

A patch is available and included in Linux kernel updates for affected versions. Users should apply the official kernel updates and reboot their systems to resolve the issue. The vendor advisory confirms the fix is released. No additional mitigations are required beyond applying the patch.