CVE-2026-90093Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt Since commit b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") l2cap_chan::conn has held reference and remains non-NULL also after the corresponding hci_conn is deleted. In this state accessing various fields eg. hci_conn::hdev is invalid, which leads to KASAN crash in l2cap_sock_setsockopt() access of conn->hcon->hdev. Check l2cap_chan::conn.hcon corresponds to an alive hci_conn before trying to use it in l2cap_sock.c. Hold l2cap_chan_lock() in getsockopt/setsockopt to ensure it stays alive, and to avoid data races in l2cap_chan fields.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d3b739db5dc6f688a60d56da872fabaf65246032 before 8460dc49c9756a1e9288218060b4d41e1b704905; from b66774b48dd98f07254951f74ea6f513efe7ff8b before f49321c85785178214fd67f2e9b4b73d6363783b; from b66774b48dd98f07254951f74ea6f513efe7ff8b before ca2c4c26498643f421d35ffe258fafbd3ed461c3; 8f90405a4a6f1f1880dc07996b47bf57c712bd8a; 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b; 8922c7940bae9ce4b1736dddb6362370793835c2; 91047a4396a8b1857a6f712a90cf33ec0012b189; 0b0e2bf39cf99e458d991b9df253727e036a7d7d; and 8 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/8460dc49c9756a1e9288218060b4d41e1b704905
- https://git.kernel.org/stable/c/f49321c85785178214fd67f2e9b4b73d6363783b
- https://git.kernel.org/stable/c/ca2c4c26498643f421d35ffe258fafbd3ed461c3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.