Executive brief
A flaw in the Linux kernel's Bluetooth L2CAP protocol handler can cause a system crash when an application attempts to get or set socket options on a Bluetooth connection. An attacker with local access could exploit this to cause a denial of service or potentially crash the entire operating system.
Technical details
A use-after-free vulnerability exists in the Linux kernel's L2CAP (Logical Link Control and Adaptation Protocol) layer, specifically in the l2cap_sock_getsockopt() and l2cap_sock_setsockopt() functions. The root cause is improper handling of the l2cap_chan::conn pointer after the underlying hci_conn is deleted; the pointer remains non-NULL but its referenced fields (such as hci_conn::hdev) become invalid. This leads to a KASAN crash when accessing conn->hcon->hdev. The vulnerability requires local access to create a malicious socket and trigger the vulnerable code path. The fix involves checking that l2cap_chan::conn.hcon corresponds to an alive hci_conn before access, holding l2cap_chan_lock() during get/setsockopt operations to prevent data races, and validating the connection state with FLAG_DEL checks.
Affected products
- Linux Linux kernel various versions prior to fix commit ca2c4c26498643f421d35ffe258fafbd3ed461c3
Timeline
- 2026-09-17: disclosed: CVE-2026-90093 published
- 2026-08-24: patched: Fix committed by Luiz Augusto von Dentz
- 2026-08-09: other: Fix authored by Pauli Virtanen