CVE-2026-90093

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-90093

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90093.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-90093

Downstream

Related

openSUSE-SU-2026:11880-1

Published

2026-09-17T16:06:06Z

Modified

2026-10-08T02:52:23Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

Since commit b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") l2cap_chan::conn has held reference and remains non-NULL also after the corresponding hci_conn is deleted. In this state accessing various fields eg. hci_conn::hdev is invalid, which leads to KASAN crash in l2cap_sock_setsockopt() access of conn->hcon->hdev.

Check l2cap_chan::conn.hcon corresponds to an alive hci_conn before trying to use it in l2cap_sock.c. Hold l2cap_chan_lock() in getsockopt/setsockopt to ensure it stays alive, and to avoid data races in l2cap_chan fields.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90093.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

b66774b48dd98f07254951f74ea6f513efe7ff8b

Fixed

f49321c85785178214fd67f2e9b4b73d6363783b

Fixed

ca2c4c26498643f421d35ffe258fafbd3ed461c3

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.10.265

Fixed

5.11

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.15.216

Fixed

5.16

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.1.183

Fixed

6.2

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.6.145

Fixed

6.7

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.12.97

Fixed

6.13

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.18.39

Fixed

6.19

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

7.1.4

Fixed

7.2

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

8f90405a4a6f1f1880dc07996b47bf57c712bd8a

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

8922c7940bae9ce4b1736dddb6362370793835c2

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

91047a4396a8b1857a6f712a90cf33ec0012b189

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

0b0e2bf39cf99e458d991b9df253727e036a7d7d

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

d3b739db5dc6f688a60d56da872fabaf65246032

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

50c38d9f42a529691e4e67ea9cedf4f0bfc8d277

Affected versions

v5.*

v5.10.265

v5.10.266

v5.10.267

v5.10.268

v5.10.269

v5.10.270

v5.10.271

v5.15.216

v5.15.217

v5.15.218

v5.15.219

v5.15.220

v5.15.221

v5.15.222

v6.*

v6.1.183

v6.1.184

v6.1.185

v6.1.186

v6.1.187

v6.1.188

v6.1.189

v6.12.100

v6.12.101

v6.12.102

v6.12.103

v6.12.104

v6.12.105

v6.12.106

v6.12.107

v6.12.108

v6.12.109

v6.12.110

v6.12.111

v6.12.112

v6.12.97

v6.12.98

v6.12.99

v6.18.39

v6.18.40

v6.18.41

v6.18.42

v6.18.43

v6.18.44

v6.18.45

v6.18.46

v6.18.47

v6.18.48

v6.18.49

v6.18.50

v6.18.51

v6.18.52

v6.18.53

v6.18.54

v6.18.55

v6.6.145

v6.6.146

v6.6.147

v6.6.148

v6.6.149

v6.6.150

v6.6.151

v6.6.152

v6.6.153

v6.6.154

v6.6.155

v6.6.156

v6.6.157

v6.6.158

v7.*

v7.1.10

v7.1.11

v7.1.12

v7.1.13

v7.1.4

v7.1.5

v7.1.6

v7.1.7

v7.1.8

v7.1.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90093.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.2.0

Fixed

7.2.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90093.json"