---
id: CVE-2024-26886
title: 'Bluetooth: af_bluetooth: Fix deadlock'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: af_bluetooth: Fix deadlock

  Attemting to do sock_lock on .recvmsg may cause a deadlock as shown
  bellow, so instead of using sock_sock this uses sk_receive_qu…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2b16d960c79abc397f102c3d23d30005b68cb036 <
    60673f442984fe689d4127a5dd4be414247b3d67
  - >-
    Linux >= 37f71e2c9f515834841826f4eb68ec33cfb2a1ff <
    0309acebc4b3884bfda332558bb8a1df052f4f39
  - >-
    Linux >= 1d576c3a5af850bf11fbd103f9ba11aa6d6061fb <
    64be3c6154886200708da0dfe259705fb992416c
  - >-
    Linux >= 2e07e8348ea454615e268222ae3fc240421be768 <
    817e8138ce86001b2fa5c63d6ede756e205a01f7
  - >-
    Linux >= 2e07e8348ea454615e268222ae3fc240421be768 <
    2c9e2df022ef8b9d7fac58a04a2ef4ed25288955
  - >-
    Linux >= 2e07e8348ea454615e268222ae3fc240421be768 <
    f7b94bdc1ec107c92262716b073b3e816d4784fb
  - Linux db1b14eec8c61a20374de9f9c2ddc6c9406a8c42
  - Linux >= 5.15.146 < 5.15.209
  - Linux >= 6.1.70 < 6.1.191
  - Linux >= 6.6.9 < 6.6.23
  - Linux >= 5.10.206 < 5.11
  - Linux 6.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-06-17T17:41:20.868479Z'
published: '2024-04-17'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:17:59.005Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-26886'
references:
  - url: 'https://git.kernel.org/stable/c/60673f442984fe689d4127a5dd4be414247b3d67'
  - url: 'https://git.kernel.org/stable/c/0309acebc4b3884bfda332558bb8a1df052f4f39'
  - url: 'https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c'
  - url: 'https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7'
  - url: 'https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955'
  - url: 'https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb'
tags:
  - cve.org
epss: 0.00489
epssPercentile: 0.4238
ingestedAt: '2026-11-03T12:44:28.801Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: af_bluetooth: Fix deadlock

Attemting to do sock_lock on .recvmsg may cause a deadlock as shown
bellow, so instead of using sock_sock this uses sk_receive_queue.lock
on bt_sock_ioctl to avoid the UAF:

INFO: task kworker/u9:1:121 blocked for more than 30 seconds.
      Not tainted 6.7.6-lemon #183
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __schedule+0x37d/0xa00
 schedule+0x32/0xe0
 __lock_sock+0x68/0xa0
 ? __pfx_autoremove_wake_function+0x10/0x10
 lock_sock_nested+0x43/0x50
 l2cap_sock_recv_cb+0x21/0xa0
 l2cap_recv_frame+0x55b/0x30a0
 ? psi_task_switch+0xeb/0x270
 ? finish_task_switch.isra.0+0x93/0x2a0
 hci_rx_work+0x33a/0x3f0
 process_one_work+0x13a/0x2f0
 worker_thread+0x2f0/0x410
 ? __pfx_worker_thread+0x10/0x10
 kthread+0xe0/0x110
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x2c/0x50
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1b/0x30
 </TASK>

## Affected

- `Linux >= 2b16d960c79abc397f102c3d23d30005b68cb036 < 60673f442984fe689d4127a5dd4be414247b3d67`
- `Linux >= 37f71e2c9f515834841826f4eb68ec33cfb2a1ff < 0309acebc4b3884bfda332558bb8a1df052f4f39`
- `Linux >= 1d576c3a5af850bf11fbd103f9ba11aa6d6061fb < 64be3c6154886200708da0dfe259705fb992416c`
- `Linux >= 2e07e8348ea454615e268222ae3fc240421be768 < 817e8138ce86001b2fa5c63d6ede756e205a01f7`
- `Linux >= 2e07e8348ea454615e268222ae3fc240421be768 < 2c9e2df022ef8b9d7fac58a04a2ef4ed25288955`
- `Linux >= 2e07e8348ea454615e268222ae3fc240421be768 < f7b94bdc1ec107c92262716b073b3e816d4784fb`
- `Linux db1b14eec8c61a20374de9f9c2ddc6c9406a8c42`
- `Linux >= 5.15.146 < 5.15.209`
- `Linux >= 6.1.70 < 6.1.191`
- `Linux >= 6.6.9 < 6.6.23`
- `Linux >= 5.10.206 < 5.11`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.