{"id":"CVE-2026-90091","published":"2026-09-17T17:17:00.563","lastModified":"2026-09-18T18:17:41.277","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan\n\nFor L2CAP sockets without owning sk->sk_socket, reading\nl2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() ->\nl2cap_sock_put_chan().  This excludes simultaneous proto_ops callbacks,\nbut access in l2cap_sock_cleanup_listen() has unsafe lockless read.\n\n [Task 1]                         [Task 2 (hdev->workqueue)]\n l2cap_sock_release(parent)       l2cap_disconn_cfm\n   l2cap_sock_cleanup_listen        l2cap_conn_del\n     bt_accept_dequeue                l2cap_chan_del\n       lock_sock(sk)                    l2cap_sock_teardown_cb\n       bt_accept_unlink\n         bt_sk(sk)->parent = NULL\n       release_sock(sk) ----------------> lock_sock(sk)\n                                          parent = /* NULL */\n     lock_sock(sk) <--------------------- release_sock(sk)\n                                          sock_set_flag(sk, SOCK_ZAPPED)\n                                      l2cap_sock_close_cb\n                                        l2cap_sock_kill(sk)\n                                          l2cap_sock_put_chan\n     chan = READ l2cap_pi(sk)->chan         l2cap_pi(sk)->chan = NULL\n     l2cap_chan_hold_unless_zero            l2cap_put_chan(chan)\n       kref_get_unless_zero(&chan->ref)\n\nTask 1 may observe NULL which causes null-ptr-deref.\n\nFix the race by taking lock_sock() in l2cap_sock_kill() to\nsynchronize with l2cap_sock_cleanup_listen().  hold_unless_zero() is not\nneeded here, l2cap_pi(sk)->chan owns reference if it is non-NULL.\n\nClarify code comments vs. locking.","cvssScore":8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61","tags":[]},{"url":"https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91","tags":[]},{"url":"https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19","tags":[]},{"url":"https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea","tags":[]},{"url":"https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442","tags":[]},{"url":"https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}