Executive brief
The Linux kernel's Bluetooth L2CAP socket implementation contains a use-after-free vulnerability in the socket accept queue handling. An attacker with local or adjacent access could trigger a race condition between socket teardown and new connection acceptance, potentially crashing the kernel or gaining code execution on systems using Bluetooth networking.
Technical details
The vulnerability is a use-after-free (UAF) in the L2CAP socket layer that arises from a race condition between parent socket teardown and new socket connection acceptance. The root cause is unsynchronized access to socket state (sk_state) in l2cap_sock_new_connection_cb(), which can execute concurrently with l2cap_sock_teardown_cb(). A parent socket can transition to BT_CLOSED state while a new connection callback attempts to add a socket to the accept queue, leading to dereferencing of a dangling parent reference. The fix adds a check for sk_state == BT_LISTEN after acquiring the socket lock in l2cap_sock_new_connection_cb(), and wraps sk_state writes with lock_sock()/release_sock() in state change and resume callbacks to prevent data races. Exploitation requires local or adjacent network access to trigger the race condition via Bluetooth L2CAP connection attempts.
Affected products
- Linux Linux kernel Multiple versions affected; patch available as of September 2026
Timeline
- 2026-09-17: disclosed: CVE-2026-90092 published
- 2026-09-14: patched: Patch committed to stable Linux kernel trees