AZL-101909
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-101909.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-101909
- Upstream
- Published
- 2026-09-17T17:17:21Z
- Modified
- 2026-09-19T05:33:49Z
- Summary
- CVE-2026-90256 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via hci_conn_timeout (disc_work) -> hci_proto_disconn_ind -> l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted concurrently.
disc_work is disabled sync in hci_conn_del(), so we cannot take hci_dev_lock in disc_work.
Fix by using proto_lock to guard l2cap_data, in addition to hdev->lock which is held in other access paths.
- References