In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix deadlock in l2capconndel()
l2capconndel() calls canceldelayedworksync() for both infotimer and idaddrtimer while holding conn->lock. However, the work functions l2capinfotimeout() and l2capconnupdateidaddr() both acquire conn->lock, creating a potential AB-BA deadlock if the work is already executing when l2capconndel() takes the lock.
Move the work cancellations before acquiring conn->lock and use disabledelayedworksync() to additionally prevent the works from being rearmed after cancellation, consistent with the pattern used in hciconn_del().
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31499.json",
"cna_assigner": "Linux"
}