{"id":"CVE-2026-90091","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-90091","summary":"Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan\n\nFor L2CAP sockets without owning sk->sk_socket, reading\nl2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() ->\nl2cap_sock_put_chan().  This excludes simultaneous proto_ops callbacks,\nbut access in l2cap_sock_cleanup_listen() has unsafe lockless read.\n\n [Task 1]                         [Task 2 (hdev->workqueue)]\n l2cap_sock_release(parent)       l2cap_disconn_cfm\n   l2cap_sock_cleanup_listen        l2cap_conn_del\n     bt_accept_dequeue                l2cap_chan_del\n       lock_sock(sk)                    l2cap_sock_teardown_cb\n       bt_accept_unlink\n         bt_sk(sk)->parent = NULL\n       release_sock(sk) ----------------> lock_sock(sk)\n                                          parent = /* NULL */\n     lock_sock(sk) <--------------------- release_sock(sk)\n                                          sock_set_flag(sk, SOCK_ZAPPED)\n                                      l2cap_sock_close_cb\n                                        l2cap_sock_kill(sk)\n                                          l2cap_sock_put_chan\n     chan = READ l2cap_pi(sk)->chan         l2cap_pi(sk)->chan = NULL\n     l2cap_chan_hold_unless_zero            l2cap_put_chan(chan)\n       kref_get_unless_zero(&chan->ref)\n\nTask 1 may observe NULL which causes null-ptr-deref.\n\nFix the race by taking lock_sock() in l2cap_sock_kill() to\nsynchronize with l2cap_sock_cleanup_listen().  hold_unless_zero() is not\nneeded here, l2cap_pi(sk)->chan owns reference if it is non-NULL.\n\nClarify code comments vs. locking.","published":"2026-09-17T16:06:05.478Z","modified":"2026-09-19T03:47:24.500097197Z","cvss":{"score":8,"severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.1.188"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91"},{"type":"WEB","url":"https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19"},{"type":"WEB","url":"https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442"},{"type":"WEB","url":"https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90091.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90091"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-19T03:47:24.500097197Z"}}