CVE-2026-90091: Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
Bluetooth: L2CAP: fix race l2capsockcleanuplisten() vs. putchan
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Fix the L2CAP race by taking lock_sock() in l2cap_sock_kill() to synchronize with l2cap_sock_cleanup_listen().
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
The race requires concurrent L2CAP socket cleanup and channel teardown activity. Specifically, l2cap_sock_cleanup_listen() can read the channel pointer while l2cap_sock_kill() concurrently clears it through l2cap_sock_put_chan().
What is the impact if the race occurs?
The cleanup path can observe a NULL channel pointer, leading to a null-pointer dereference in the kernel.
Does the fix rely on preventing simultaneous protocol-operation callbacks?
No. The issue concerns an unsafe lockless access in l2cap_sock_cleanup_listen(), even though simultaneous proto_ops callbacks are excluded. The fix synchronizes the paths by taking lock_sock() in l2cap_sock_kill().