Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-90256

Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via hci_conn_timeout (disc_work) -> hci_proto_disconn_ind -> l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted concurrently. disc_work is disabled sync in hci_conn_del(), so we cannot take hci_dev_lock in disc_work. Fix by using proto_lock to guard l2cap_data, in addition to hdev->lock which is held in other access paths.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • efc30877bd4bc85fefe98d80af60fafc86e5775e to < 0fa448369c87e20b2aeaeaca0187d698dd61f791affected
  • f87271d21dd4ee83857ca11b94e7b4952749bbae to < 7c032b6d48a46634cbd58aaebad2638c00ad3b51affected
  • ab4eedb790cae44313759b50fe47da285e2519d5 to < b495a3a9b33bc4e4613e685bf5c96c136caa22d8affected
  • ab4eedb790cae44313759b50fe47da285e2519d5 to < 2b66c83ff1751d6bd3201b3017206262ab46dc05affected
  • 18ab6b6078fa8191ca30a3065d57bf35d5635761affected
  • 6.6.84 to < 6.6.160affected
  • 6.12.20 to < 6.12.114affected
  • 6.13.8 to < 6.14affected

Linux Linux

Default version status: affected

  • 6.14affected
  • 0 to < 6.14unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.114 to ≤ 6.12.*unaffected
  • 7.2.6 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References