Executive brief
A use-after-free vulnerability exists in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation. The flaw allows concurrent access to connection data without proper synchronization, potentially leading to a denial of service or memory corruption when Bluetooth connections are disconnected. This affects systems with Bluetooth capabilities that handle L2CAP protocol operations.
Technical details
The vulnerability is a use-after-free (UAF) race condition in the L2CAP disconnect indication handler (l2cap_disconn_ind). The function accesses hci_conn::l2cap_data without holding the proto_lock, while l2cap_conn can be deleted concurrently by other code paths. The issue manifests when hci_conn_timeout invokes l2cap_disconn_ind via the disc_work timer callback, which cannot safely acquire hci_dev_lock due to being disabled synchronously in hci_conn_del(). The fix adds proto_lock spinlock guards around all access to l2cap_data in multiple code paths (l2cap_conn_add, l2cap_conn_del, and l2cap_disconn_ind) to prevent concurrent modification and dereferencing of freed memory.
Affected products
- Linux Linux kernel multiple versions prior to 2026-08-07
Timeline
- 2026-09-17: disclosed: CVE-2026-90256 published
- 2026-08-07: patched: Fix committed upstream by Luiz Augusto von Dentz
- 2026-08-01: other: Fix authored by Pauli Virtanen