UBUNTU-CVE-2026-90091: High severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten() vs. putchan For L2CAP sockets without owning sk->sksocket, reading l2cappi(sk)->chan may race against concurrent l2capsockkill() -> l2capsockputchan(). This excludes simultaneous protoops callbacks, but access in l2capsockcleanuplisten() has unsafe lockless read. [Task 1] [Task 2 (hdev->workqueue)] l2capsockrelease(parent) l2capdisconncfm l2capsockcleanuplisten l2capconndel btacceptdequeue l2capchandel locksock(sk) l2capsockteardowncb btacceptunlink btsk(sk)->parent = NULL releasesock(sk) ----------------> locksock(sk) parent = / NULL / locksock(sk) <--------------------- releasesock(sk) socksetflag(sk, SOCKZAPPED) l2capsockclosecb l2capsockkill(sk) l2capsockputchan chan = READ l2cappi(sk)->chan l2cappi(sk)->chan = NULL l2capchanholdunlesszero l2capputchan(chan) krefgetunlesszero(&chan->ref) Task 1 may observe NULL which causes null-ptr-deref. Fix the race by taking locksock() in l2capsockkill() to synchronize with l2capsockcleanuplisten(). holdunlesszero() is not needed here, l2cappi(sk)->chan owns reference if it is non-NULL. Clarify code comments vs. locking.