In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_chan_close() removes the channel from conn->chan_l, which must be done under conn->lock. cleanup_listen() runs under the parent sk_lock, so acquiring conn->lock would invert the established conn->lock -> chan->lock -> sk_lock order. Instead of calling l2cap_chan_close() directly, schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously. The timeout handler already acquires conn->lock and chan->lock in the correct order. The timer is only armed when chan->conn is still set: if it is already NULL, l2cap_conn_del() has already processed this channel (l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb), so there is nothing left to do. If l2cap_conn_del() races in after the timer is armed, __clear_chan_timer() inside l2cap_chan_del() cancels it; if the timer has already fired, the handler returns harmlessly because chan->conn was cleared.

opensuse openSUSE-SU-2026:21555-1: openSUSE 16 : Security update for the Linux Kernel (Important) (openSUSE-SU-2026:21555-1)

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_chan_close() removes the     channel from conn->chan_l, which must be done under conn->lock. cleanup_listen() runs under the parent     sk_lock, so acquiring conn->lock would invert the established conn->lock -> chan->lock -> sk_lock order.
    Instead of calling l2cap_chan_close() directly, schedule l2cap_chan_timeout with delay 0 to close the     channel asynchronously. The timeout handler already acquires conn->lock and chan->lock in the correct     order. The timer is only armed when chan->conn is still set: if it is already NULL, l2cap_conn_del() has     already processed this channel (l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb), so there     is nothing left to do. If l2cap_conn_del() races in after the timer is armed, __clear_chan_timer() inside     l2cap_chan_del() cancels it; if the timer has already fired, the handler returns harmlessly because     chan->conn was cleared. (CVE-2026-53358)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
329149	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3166-1)	Nessus	SuSE Local Security Checks	Local	medium
324899	Linux Distros Unpatched Vulnerability : CVE-2026-53358	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-53358

high

Tenable Plugins

Coming Soon

high

high

medium

high