CVE-2026-90091Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan For L2CAP sockets without owning sk->sk_socket, reading l2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() -> l2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks, but access in l2cap_sock_cleanup_listen() has unsafe lockless read. [Task 1] [Task 2 (hdev->workqueue)] l2cap_sock_release(parent) l2cap_disconn_cfm l2cap_sock_cleanup_listen l2cap_conn_del bt_accept_dequeue l2cap_chan_del lock_sock(sk) l2cap_sock_teardown_cb bt_accept_unlink bt_sk(sk)->parent = NULL release_sock(sk) ----------------> lock_sock(sk) parent = /* NULL */ lock_sock(sk) <--------------------- release_sock(sk) sock_set_flag(sk, SOCK_ZAPPED) l2cap_sock_close_cb l2cap_sock_kill(sk) l2cap_sock_put_chan chan = READ l2cap_pi(sk)->chan l2cap_pi(sk)->chan = NULL l2cap_chan_hold_unless_zero l2cap_put_chan(chan) kref_get_unless_zero(&chan->ref) Task 1 may observe NULL which causes null-ptr-deref. Fix the race by taking lock_sock() in l2cap_sock_kill() to synchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not needed here, l2cap_pi(sk)->chan owns reference if it is non-NULL. Clarify code comments vs. locking.
- CVSS
- 8.0 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b39298044e5534612511a2ff5de03ba5f6e7a820 before 827de6bd2865b22aaabd554540def3b8a33018ab; 8c37e4338c801ebb8cee52436c01c41e009f6e87 builds before 7c7ac736b50fa259ed1bdddc18d79523f07c0442; 84e718b6a814edc84159361f9f454a4e92ae91ae builds before 4f8c63fe0097c9f6ea34409f82f79b3894903d91; from 36da806f7fbaee56ad9e81859deec203f9728700 before 61d5ddbd524c715b224cbe7e9f01da4e05098b19; from 6fef032af0092ed5ccb767239a9ac1bc38c08a40 before 32a7bc6e93be36b37fe61f351d312d358195bd61; from 6fef032af0092ed5ccb767239a9ac1bc38c08a40 before 66d6ef18548ae6d7dd452b84115fc82c0a73a4ea; 733e76e74e406c1d1ddc7369420dd8a47f48bb8a; from 6.1.178 before 6.1.188; and 4 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab
- https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442
- https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91
- https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19
- https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61
- https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.