CVE-2026-90091

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

For L2CAP sockets without owning sk->sk_socket, reading

l2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() ->

l2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks,

but access in l2cap_sock_cleanup_listen() has unsafe lockless read.

[Task 1] [Task 2 (hdev->workqueue)]

l2cap_sock_release(parent) l2cap_disconn_cfm

l2cap_sock_cleanup_listen l2cap_conn_del

bt_accept_dequeue l2cap_chan_del

lock_sock(sk) l2cap_sock_teardown_cb

bt_accept_unlink

bt_sk(sk)->parent = NULL

release_sock(sk) ----------------> lock_sock(sk)

parent = /* NULL */

lock_sock(sk) <--------------------- release_sock(sk)

sock_set_flag(sk, SOCK_ZAPPED)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References