CVE-2026-90092

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

New sk should not be added to parent socket accept queue after last

l2cap_sock_cleanup_listen() has run in l2cap_sock_teardown_cb() and

state set to BT_CLOSED, as that can result to UAF on dereferencing the

dangling parent reference.

l2cap_sock_new_connection_cb() may race with parent l2cap_chan teardown,

due to chan->state accessed without consistent locking:

[Task 1] [Task 2]

l2cap_sock_release(parent) l2cap_connect

l2cap_sock_shutdown pchan = l2cap_global_chan_by_psm

l2cap_chan_lock(pchan)

l2cap_chan_close

l2cap_sock_teardown_cb

pchan->state = BT_CLOSED

l2cap_chan_unlock(pchan) ------> l2cap_chan_lock(pchan)

l2cap_new_connection

l2cap_sock_new_connection_cb

l2cap_chan_lock(pchan

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References