CVE-2026-90256

HighCVSS 8.8/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind

hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via hci_conn_timeout (disc_work) -> hci_proto_disconn_ind -> l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted concurrently.

disc_work is disabled sync in hci_conn_del(), so we cannot take hci_dev_lock in disc_work.

Fix by using proto_lock to guard l2cap_data, in addition to hdev->lock which is held in other access paths.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= efc30877bd4bc85fefe98d80af60fafc86e5775e, < 0fa448369c87e20b2aeaeaca0187d698dd61f791; >= f87271d21dd4ee83857ca11b94e7b4952749bbae, < 7c032b6d48a46634cbd58aaebad2638c00ad3b51; >= ab4eedb790cae44313759b50fe47da285e2519d5, < b495a3a9b33bc4e4613e685bf5c96c136caa22d8; >= ab4eedb790cae44313759b50fe47da285e2519d5, < 2b66c83ff1751d6bd3201b3017206262ab46dc05; 18ab6b6078fa8191ca30a3065d57bf35d5635761; >= 6.6.84, < 6.6.160; >= 6.12.20, < 6.12.114; >= 6.13.8, < 6.14
LinuxLinux6.14

References

Timeline

Published
Sep 17, 2026
Last modified
Oct 21, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-90257In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: avoid OOB read of build info string The virtbt_sCVE-2026-90258In the Linux kernel, the following vulnerability has been resolved: pinctrl: airoha: add missed IRQ resource helpers Without hooking .irq_CVE-2026-90259In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_dCVE-2026-902607.1In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't clobber the extent buffer when zeroing it out On aCVE-2026-90261In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: flush active metadata block group at btree_writepages() sCVE-2026-90262In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfs_read_meCVE-2026-90263In the Linux kernel, the following vulnerability has been resolved: btrfs: check if root is readonly when setting posix acl For a filesystCVE-2026-90264In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races [BUG] Syzbot CVE-2026-90265In the Linux kernel, the following vulnerability has been resolved: btrfs: defrag: fix deadlock between defrag and delalloc space reservatiCVE-2026-90266In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merCVE-2026-90267In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() failsCVE-2026-902688.1In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sd_probe() after large pool creation fa
CVE-2026-90256: High severity, CVSS 8.8 | Vulnix