< Back

CVE-2026-90256

Updated on 17 Sep 2026

Severity

8.8 High severity

Details

CVSS score
8.8
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind

hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via hci_conn_timeout (disc_work) -> hci_proto_disconn_ind -> l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted concurrently.

disc_work is disabled sync in hci_conn_del(), so we cannot take hci_dev_lock in disc_work.

Fix by using proto_lock to guard l2cap_data, in addition to hdev->lock which is held in other access paths.

Details

Affected product:
AlmaLinux 9.2 ESU , TuxCare 9.6 ESU , TuxCare 9.8 ESU
Affected packages:
kernel @ 5.14.0 (+2 more)

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Debian 13 Planned —
Ubuntu 26.04 Planned —