CVE-2026-90092: Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
Bluetooth: L2CAP: reject accept queue add unless BTLISTEN
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel Bluetooth L2CAP implementation, add lock_sock() around sk_state writes where missing and, after acquiring the socket lock in l2cap_sock_new_connection_cb(), reject adding a new socket to the accept queue unless sk_state == BT_LISTEN.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
A race must occur between teardown of an L2CAP parent socket that was listening and creation of a new L2CAP connection. The new connection callback can otherwise add a child socket to the parent accept queue after the parent has been closed and its parent reference has become dangling.
Which Linux systems are exposed?
Systems using the Linux kernel Bluetooth L2CAP socket handling are relevant. The provided information does not identify affected kernel versions, configurations, or whether Bluetooth must be enabled and in active use.
How does the fix prevent the use-after-free?
The fix checks that the socket state is still BT_LISTEN after acquiring the socket lock before adding a new socket to the accept queue. It also adds socket locking around previously unprotected socket-state writes to prevent data races.