important · Bluetooth — Linux kernel
Linux can dereference freed L2CAP state during concurrent Bluetooth teardown.
Affects
Linux kernel Bluetooth hosts using the affected L2CAP teardown path.
Unlocked access to hci_conn::l2cap_data can race with deletion of its l2cap_conn during disconnect-timeout work; an upstream patch is available.
Detail and 1 source
Chain to watch
Begin L2CAP teardown during disconnect-timeout work→↓Delete the referenced l2cap_conn→↓Dereference the freed state→↓Peer-driven scheduling and controlled corruption remain unproven.
Unverified chainReproduce through a real controller under KASAN, vary peer-driven disconnect timing, and groom the freed allocation.
No public source establishes that a nearby peer can reliably schedule the race or turn it into controlled corruption.