{"id":"CVE-2026-90091","revision":"5aa352e3d8204811949d53f28dfaa695","records":[{"revision":"5aa352e3d8204811949d53f28dfaa695","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90091","aliases":[],"title":"Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan\n\nFor L2CAP sockets without owning sk->sk_socket, reading\nl2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() ->\nl2cap_sock_put_chan().  This excludes simultaneous proto_ops callbacks,\nbut access in l2cap_sock_cleanup_listen() has unsafe lockless read.\n\n [Task 1]                         [Task 2 (hdev->workqueue)]\n l2cap_sock_release(parent)       l2cap_disconn_cfm\n   l2cap_sock_cleanup_listen        l2cap_conn_del\n     bt_accept_dequeue                l2cap_chan_del\n       lock_sock(sk)                    l2cap_sock_teardown_cb\n       bt_accept_unlink\n         bt_sk(sk)->parent = NULL\n       release_sock(sk) ----------------> lock_sock(sk)\n                                          parent = /* NULL */\n     lock_sock(sk) <--------------------- release_sock(sk)\n                                          sock_set_flag(sk, SOCK_ZAPPED)\n                                      l2cap_sock_close_cb\n                                        l2cap_sock_kill(sk)\n                                          l2cap_sock_put_chan\n     chan = READ l2cap_pi(sk)->chan         l2cap_pi(sk)->chan = NULL\n     l2cap_chan_hold_unless_zero            l2cap_put_chan(chan)\n       kref_get_unless_zero(&chan->ref)\n\nTask 1 may observe NULL which causes null-ptr-deref.\n\nFix the race by taking lock_sock() in l2cap_sock_kill() to\nsynchronize with l2cap_sock_cleanup_listen().  hold_unless_zero() is not\nneeded here, l2cap_pi(sk)->chan owns reference if it is non-NULL.\n\nClarify code comments vs. locking.","state":0,"publishedAt":"2026-09-17T16:06:05.478+00:00","modifiedAt":"2026-10-19T08:57:49.423+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/bluetooth/l2cap.h\",\n                        \"net/bluetooth/l2cap_sock.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b39298044e5534612511a2ff5de03ba5f6e7a820\",\n                            \"lessThan\": \"827de6bd2865b22aaabd554540def3b8a33018ab\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8c37e4338c801ebb8cee52436c01c41e009f6e87\",\n                            \"lessThan\": \"7c7ac736b50fa259ed1bdddc18d79523f07c0442\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"84e718b6a814edc84159361f9f454a4e92ae91ae\",\n                            \"lessThan\": \"4f8c63fe0097c9f6ea34409f82f79b3894903d91\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"36da806f7fbaee56ad9e81859deec203f9728700\",\n                            \"lessThan\": \"61d5ddbd524c715b224cbe7e9f01da4e05098b19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6fef032af0092ed5ccb767239a9ac1bc38c08a40\",\n                            \"lessThan\": \"32a7bc6e93be36b37fe61f351d312d358195bd61\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6fef032af0092ed5ccb767239a9ac1bc38c08a40\",\n                            \"lessThan\": \"66d6ef18548ae6d7dd452b84115fc82c0a73a4ea\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"733e76e74e406c1d1ddc7369420dd8a47f48bb8a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThan\": \"6.1.188\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThan\": \"6.6.157\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.97\",\n                            \"lessThan\": \"6.12.110\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.40\",\n                            \"lessThan\": \"6.18.52\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.5\",\n                            \"lessThan\": \"7.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/bluetooth/l2cap.h\",\n                        \"net/bluetooth/l2cap_sock.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab","https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442","https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91","https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19","https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61","https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90091","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90091","identifiers":["CVE-2026-90091"]},"retained":false,"historicalAffected":[]}],"coverage":[]}