CVE-2026-90091
- Source
- https://cve.org/CVERecord?id=CVE-2026-90091
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90091.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-90091
- Downstream
- Related
- Published
- 2026-09-17T16:06:05Z
- Modified
- 2026-10-08T02:53:13Z
- Severity
-
- 8.0 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
For L2CAP sockets without owning sk->sk_socket, reading l2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() -> l2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks, but access in l2cap_sock_cleanup_listen() has unsafe lockless read.
[Task 1] [Task 2 (hdev->workqueue)] l2cap_sock_release(parent) l2cap_disconn_cfm l2cap_sock_cleanup_listen l2cap_conn_del bt_accept_dequeue l2cap_chan_del lock_sock(sk) l2cap_sock_teardown_cb bt_accept_unlink bt_sk(sk)->parent = NULL release_sock(sk) ----------------> lock_sock(sk) parent = /* NULL */ lock_sock(sk) <--------------------- release_sock(sk) sock_set_flag(sk, SOCK_ZAPPED) l2cap_sock_close_cb l2cap_sock_kill(sk) l2cap_sock_put_chan chan = READ l2cap_pi(sk)->chan l2cap_pi(sk)->chan = NULL l2cap_chan_hold_unless_zero l2cap_put_chan(chan) kref_get_unless_zero(&chan->ref)
Task 1 may observe NULL which causes null-ptr-deref.
Fix the race by taking lock_sock() in l2cap_sock_kill() to synchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not needed here, l2cap_pi(sk)->chan owns reference if it is non-NULL.
Clarify code comments vs. locking.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90091.json" }- References
-
- https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61
- https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91
- https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19
- https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea
- https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442
- https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90091.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-90091
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb39298044e5534612511a2ff5de03ba5f6e7a820Fixed827de6bd2865b22aaabd554540def3b8a33018ab
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8c37e4338c801ebb8cee52436c01c41e009f6e87Fixed7c7ac736b50fa259ed1bdddc18d79523f07c0442
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced84e718b6a814edc84159361f9f454a4e92ae91aeFixed4f8c63fe0097c9f6ea34409f82f79b3894903d91
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced36da806f7fbaee56ad9e81859deec203f9728700Fixed61d5ddbd524c715b224cbe7e9f01da4e05098b19
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6fef032af0092ed5ccb767239a9ac1bc38c08a40Fixed32a7bc6e93be36b37fe61f351d312d358195bd61Fixed66d6ef18548ae6d7dd452b84115fc82c0a73a4ea
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.1.178Fixed6.1.188
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.145Fixed6.6.157
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.97Fixed6.12.110
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.18.40Fixed6.18.52
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7.1.5Fixed7.2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced733e76e74e406c1d1ddc7369420dd8a47f48bb8a
Affected versions
v6.*
v7.*
Linux / Kernel
Package
- Name
- Kernel
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed6.1.188
- Type
- ECOSYSTEM
- Events
-
Introduced6.2.0Fixed6.6.157
- Type
- ECOSYSTEM
- Events
-
Introduced6.7.0Fixed6.12.110
- Type
- ECOSYSTEM
- Events
-
Introduced6.13.0Fixed6.18.52
- Type
- ECOSYSTEM
- Events
-
Introduced6.19.0Fixed7.2.6