CVE-2026-90091 - Vulnerability Details

- Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

For L2CAP sockets without owning sk->sk_socket, reading
l2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() ->
l2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks,
but access in l2cap_sock_cleanup_listen() has unsafe lockless read.

[Task 1] [Task 2 (hdev->workqueue)]
l2cap_sock_release(parent) l2cap_disconn_cfm
l2cap_sock_cleanup_listen l2cap_conn_del
bt_accept_dequeue l2cap_chan_del
lock_sock(sk) l2cap_sock_teardown_cb
bt_accept_unlink
bt_sk(sk)->parent = NULL
release_sock(sk) ----------------> lock_sock(sk)
parent = /* NULL */
lock_sock(sk) <--------------------- release_sock(sk)
sock_set_flag(sk, SOCK_ZAPPED)
l2cap_sock_close_cb
l2cap_sock_kill(sk)
l2cap_sock_put_chan
chan = READ l2cap_pi(sk)->chan l2cap_pi(sk)->chan = NULL
l2cap_chan_hold_unless_zero l2cap_put_chan(chan)
kref_get_unless_zero(&chan->ref)

Task 1 may observe NULL which causes null-ptr-deref.

Fix the race by taking lock_sock() in l2cap_sock_kill() to
synchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not
needed here, l2cap_pi(sk)->chan owns reference if it is non-NULL.

Clarify code comments vs. locking.

Published: 2026-09-17

Score: 8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the Linux kernel’s Bluetooth L2CAP implementation allows a concurrent call to l2cap_sock_cleanup_listen() and l2cap_sock_put_chan() to result in an unsafe lockless read of a channel pointer that may be null. This can trigger a null‑pointer dereference in kernel mode, potentially causing a kernel panic and denying service to the system. The weakness is a classic example of improper synchronization that leads to a null pointer dereference.

Affected Systems

The vulnerability affects the Linux kernel’s Bluetooth stack across all versions that include the buggy L2CAP code. No specific kernel release numbers are listed, so any unpatched Linux kernel running the Bluetooth stack is potentially impacted.

Risk and Exploitability

The CVSS score of 8 indicates a high severity. The EPSS score is below 1%, suggesting current exploitation likelihood is low, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, via crafted Bluetooth L2CAP traffic that triggers the race, potentially allowing an attacker to force a kernel crash from a Bluetooth connection.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b39298044e5534612511a2ff5de03ba5f6e7a820`	affected	< 827de6bd2865b22aaabd554540def3b8a33018ab
`8c37e4338c801ebb8cee52436c01c41e009f6e87`	affected	< 7c7ac736b50fa259ed1bdddc18d79523f07c0442
`84e718b6a814edc84159361f9f454a4e92ae91ae`	affected	< 4f8c63fe0097c9f6ea34409f82f79b3894903d91
`36da806f7fbaee56ad9e81859deec203f9728700`	affected	< 61d5ddbd524c715b224cbe7e9f01da4e05098b19
`6fef032af0092ed5ccb767239a9ac1bc38c08a40`	affected	< 32a7bc6e93be36b37fe61f351d312d358195bd61
`6fef032af0092ed5ccb767239a9ac1bc38c08a40`	affected	< 66d6ef18548ae6d7dd452b84115fc82c0a73a4ea
`733e76e74e406c1d1ddc7369420dd8a47f48bb8a`	affected	—
`6.1.178`	affected	< 6.1.188
`6.6.145`	affected	< 6.6.157
`6.12.97`	affected	< 6.12.110
`6.18.40`	affected	< 6.18.52
`7.1.5`	affected	< 7.2

Linux

affected

Version	Status	Constraints
`7.2`	affected	—
`0`	unaffected	< 7.2
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b39298044e5534612511a2ff5de03ba5f6e7a820,827de6bd2865b22aaabd554540def3b8a33018ab)`	affected	code_commit	—
`[8c37e4338c801ebb8cee52436c01c41e009f6e87,7c7ac736b50fa259ed1bdddc18d79523f07c0442)`	affected	code_commit	—
`[84e718b6a814edc84159361f9f454a4e92ae91ae,4f8c63fe0097c9f6ea34409f82f79b3894903d91)`	affected	code_commit	—
`[36da806f7fbaee56ad9e81859deec203f9728700,61d5ddbd524c715b224cbe7e9f01da4e05098b19)`	affected	code_commit	—
`[6fef032af0092ed5ccb767239a9ac1bc38c08a40,32a7bc6e93be36b37fe61f351d312d358195bd61)`	affected	code_commit	—
`[6fef032af0092ed5ccb767239a9ac1bc38c08a40,66d6ef18548ae6d7dd452b84115fc82c0a73a4ea)`	affected	code_commit	—
`733e76e74e406c1d1ddc7369420dd8a47f48bb8a`	affected	code_commit	—
`[6.1.178,6.1.188)`	affected	semver	—
`[6.6.145,6.6.157)`	affected	semver	—
`[6.12.97,6.12.110)`	affected	semver	—
`[6.18.40,6.18.52)`	affected	semver	—
`[7.1.5,7.2)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`7.2`	affected	generic	—
`[0,7.2)`	unaffected	generic	—
`[6.1.188,6.1.*]`	unaffected	generic	—
`[6.6.157,6.6.*]`	unaffected	generic	—
`[6.12.110,6.12.*]`	unaffected	generic	—
`[6.18.52,6.18.*]`	unaffected	generic	—
`[7.2.6,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest stable Linux kernel update that includes the L2CAP race condition fix (commit IDs are listed in the provided references).
If patching is not immediately possible, disable or restrict the system’s Bluetooth services to prevent L2CAP connections while awaiting the kernel patch.
Restrict Bluetooth traffic to trusted devices by configuring a firewall or ACL, or block all L2CAP traffic using kernel parameters until the patch is available.

Generated by OpenCVE AI on September 20, 2026 at 04:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00415.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61
https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91
https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19
https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea
https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442
https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab

History

Sun, 20 Sep 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-410 CWE-476

Fri, 18 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan For L2CAP sockets without owning sk->sk_socket, reading l2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() -> l2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks, but access in l2cap_sock_cleanup_listen() has unsafe lockless read. [Task 1] [Task 2 (hdev->workqueue)] l2cap_sock_release(parent) l2cap_disconn_cfm l2cap_sock_cleanup_listen l2cap_conn_del bt_accept_dequeue l2cap_chan_del lock_sock(sk) l2cap_sock_teardown_cb bt_accept_unlink bt_sk(sk)->parent = NULL release_sock(sk) ----------------> lock_sock(sk) parent = /* NULL */ lock_sock(sk) <--------------------- release_sock(sk) sock_set_flag(sk, SOCK_ZAPPED) l2cap_sock_close_cb l2cap_sock_kill(sk) l2cap_sock_put_chan chan = READ l2cap_pi(sk)->chan l2cap_pi(sk)->chan = NULL l2cap_chan_hold_unless_zero l2cap_put_chan(chan) kref_get_unless_zero(&chan->ref) Task 1 may observe NULL which causes null-ptr-deref. Fix the race by taking lock_sock() in l2cap_sock_kill() to synchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not needed here, l2cap_pi(sk)->chan owns reference if it is non-NULL. Clarify code comments vs. locking.
Title		Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61 https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91 https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19 https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442 https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:06:05.478Z

Updated: 2026-09-18T17:52:56.765Z

Reserved: 2026-09-11T19:38:34.786Z

Link: CVE-2026-90091

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:00.563

Modified: 2026-09-18T18:17:41.277

Link: CVE-2026-90091

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T04:15:17Z

Weaknesses

CWE-410
Insufficient Resource Pool
CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object