CVE-2026-90091

Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

State: Published
Severity: 8.0 High
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

For L2CAP sockets without owning sk->sk_socket, reading l2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() -> l2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks, but access in l2cap_sock_cleanup_listen() has unsafe lockless read.

[Task 1] [Task 2 (hdev->workqueue)] l2cap_sock_release(parent) l2cap_disconn_cfm l2cap_sock_cleanup_listen l2cap_conn_del bt_accept_dequeue l2cap_chan_del lock_sock(sk) l2cap_sock_teardown_cb bt_accept_unlink bt_sk(sk)->parent = NULL release_sock(sk) ----------------> lock_sock(sk) parent = /* NULL */ lock_sock(sk) <--------------------- release_sock(sk) sock_set_flag(sk, SOCK_ZAPPED) l2cap_sock_close_cb l2cap_sock_kill(sk) l2cap_sock_put_chan chan = READ l2cap_pi(sk)->chan l2cap_pi(sk)->chan = NULL l2cap_chan_hold_unless_zero l2cap_put_chan(chan) kref_get_unless_zero(&chan->ref)

Task 1 may observe NULL which causes null-ptr-deref.

Fix the race by taking lock_sock() in l2cap_sock_kill() to synchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not needed here, l2cap_pi(sk)->chan owns reference if it is non-NULL.

Clarify code comments vs. locking.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b39298044e5534612511a2ff5de03ba5f6e7a820 to before 827de6bd2865b22aaabd554540def3b8a33018abAffected 8c37e4338c801ebb8cee52436c01c41e009f6e87 to before 7c7ac736b50fa259ed1bdddc18d79523f07c0442Affected 84e718b6a814edc84159361f9f454a4e92ae91ae to before 4f8c63fe0097c9f6ea34409f82f79b3894903d91Affected 36da806f7fbaee56ad9e81859deec203f9728700 to before 61d5ddbd524c715b224cbe7e9f01da4e05098b19Affected 6fef032af0092ed5ccb767239a9ac1bc38c08a40 to before 32a7bc6e93be36b37fe61f351d312d358195bd61Affected 6fef032af0092ed5ccb767239a9ac1bc38c08a40 to before 66d6ef18548ae6d7dd452b84115fc82c0a73a4eaAffected 733e76e74e406c1d1ddc7369420dd8a47f48bb8aAffected 6.1.178 to before 6.1.188Affected 6.6.145 to before 6.6.157Affected 6.12.97 to before 6.12.110Affected 6.18.40 to before 6.18.52Affected 7.1.5 to before 7.2Affected
LinuxLinux	7.2Affected before 7.2Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

b39298044e5534612511a2ff5de03ba5f6e7a820 to before 827de6bd2865b22aaabd554540def3b8a33018abAffected
8c37e4338c801ebb8cee52436c01c41e009f6e87 to before 7c7ac736b50fa259ed1bdddc18d79523f07c0442Affected
84e718b6a814edc84159361f9f454a4e92ae91ae to before 4f8c63fe0097c9f6ea34409f82f79b3894903d91Affected
36da806f7fbaee56ad9e81859deec203f9728700 to before 61d5ddbd524c715b224cbe7e9f01da4e05098b19Affected
6fef032af0092ed5ccb767239a9ac1bc38c08a40 to before 32a7bc6e93be36b37fe61f351d312d358195bd61Affected
6fef032af0092ed5ccb767239a9ac1bc38c08a40 to before 66d6ef18548ae6d7dd452b84115fc82c0a73a4eaAffected
733e76e74e406c1d1ddc7369420dd8a47f48bb8aAffected
6.1.178 to before 6.1.188Affected
6.6.145 to before 6.6.157Affected
6.12.97 to before 6.12.110Affected
6.18.40 to before 6.18.52Affected
7.1.5 to before 7.2Affected

LinuxLinux

7.2Affected
before 7.2Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.