Linux Kernel Bluetooth L2CAP Channel Reference Leak Vulnerability

A vulnerability in the Linux kernel's Bluetooth L2CAP implementation has been addressed. The issue involved a channel reference leak in the function 'l2cap_chan_timeout()'. When the channel connection was NULL, the function returned early without releasing a held reference, causing a memory leak. The vulnerability affected the stable Linux kernel versions prior to the fix, which is available in the Linux stable tree.

Impact

The vulnerability could lead to a memory leak by not properly releasing channel references, potentially causing increased memory usage over time.

Reproduction

The vulnerability can be reproduced by setting a Bluetooth L2CAP channel timer and then allowing the timer to expire while the channel connection is NULL. This will trigger the 'l2cap_chan_timeout()' function, which will leak the held channel reference instead of releasing it as intended.

Remediation

Users can upgrade to the latest version of the Linux kernel available in the Linux stable tree to address this vulnerability.