{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da","status":"affected","version":"f87271d21dd4ee83857ca11b94e7b4952749bbae","versionType":"git"},{"lessThan":"3f26ecbd9cde621dd94be7ef252c7210b965a5c7","status":"affected","version":"ab4eedb790cae44313759b50fe47da285e2519d5","versionType":"git"},{"lessThan":"d008460de352e534f6721de829b093368564ec66","status":"affected","version":"ab4eedb790cae44313759b50fe47da285e2519d5","versionType":"git"},{"lessThan":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","status":"affected","version":"ab4eedb790cae44313759b50fe47da285e2519d5","versionType":"git"},{"status":"affected","version":"efc30877bd4bc85fefe98d80af60fafc86e5775e","versionType":"git"},{"status":"affected","version":"18ab6b6078fa8191ca30a3065d57bf35d5635761","versionType":"git"},{"lessThan":"6.12.88","status":"affected","version":"6.12.20","versionType":"semver"},{"lessThan":"6.7","status":"affected","version":"6.6.84","versionType":"semver"},{"lessThan":"6.14","status":"affected","version":"6.13.8","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.88","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-31499","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix deadlock in l2cap_conn_del()\n\nl2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer\nand id_addr_timer while holding conn->lock. However, the work functions\nl2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire\nconn->lock, creating a potential AB-BA deadlock if the work is already\nexecuting when l2cap_conn_del() takes the lock.\n\nMove the work cancellations before acquiring conn->lock and use\ndisable_delayed_work_sync() to additionally prevent the works from\nbeing rearmed after cancellation, consistent with the pattern used in\nhci_conn_del().","epss":{"date":"2026-11-05","percentile":0.00589,"score":0.00094},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793915103365,"publishedAt":1776866060384,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/3f26ecbd9cde621dd94be7ef252c7210b965a5c7"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/d008460de352e534f6721de829b093368564ec66"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608"}],"remediation":[],"revision":"5c28fb6b3419d1cb4068e8de0c21059f0f3930d5b30ab9fcd32f2f3918ee6ec8","sources":[{"modifiedAt":1793915103365,"name":"CNA: Linux","retrievedAt":1793917070357,"url":"https://www.cve.org/CVERecord?id=CVE-2026-31499"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793917073285,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31499"}],"ssvc":{"assessedAt":1793914551710,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()","updatedAt":1793917073285}