CVE-2026-90256
Received
Received - Intake
BaseFortify
Vulnerability report for CVE-2026-90256, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-17
Last updated on: 2026-09-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via
hci_conn_timeout (disc_work) -> hci_proto_disconn_ind ->
l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted
concurrently.
disc_work is disabled sync in hci_conn_del(), so we cannot take
hci_dev_lock in disc_work.
Fix by using proto_lock to guard l2cap_data, in addition to hdev->lock
which is held in other access paths.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | ab4eedb790cae44313759b50fe47da285e2519d5 |
| Linux | Linux | ab4eedb790cae44313759b50fe47da285e2519d5 |
| Linux | Linux | efc30877bd4bc85fefe98d80af60fafc86e5775e |
| Linux | Linux | f87271d21dd4ee83857ca11b94e7b4952749bbae |
| Linux | Linux | 18ab6b6078fa8191ca30a3065d57bf35d5635761 |
| Linux | Linux | 6.6.84 |
| Linux | Linux | 6.12.20 |
| Linux | Linux | 6.13.8 |
| Linux | Linux | 6.14 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
