Technical Summary

The Linux kernel Bluetooth L2CAP subsystem had a vulnerability related to improper lock handling during channel closure in cleanup_listen(). The function l2cap_chan_close() removes channels under conn->lock, but cleanup_listen() runs under sk_lock, and acquiring conn->lock there would invert the expected lock order (conn->lock -> chan->lock -> sk_lock). To fix this, the channel closure is deferred asynchronously by scheduling l2cap_chan_timeout with zero delay, which acquires locks in the correct order. The timer is only armed if chan->conn is set, preventing race conditions with l2cap_conn_del(). This fix prevents potential concurrency issues in Bluetooth channel cleanup.