CVE-2026-90256 PUBLISHED

Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind

Assigner: Linux
Reserved: 11.09.2026 Published: 17.09.2026 Updated: 17.09.2026

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind

hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via hci_conn_timeout (disc_work) -> hci_proto_disconn_ind -> l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted concurrently.

disc_work is disabled sync in hci_conn_del(), so we cannot take hci_dev_lock in disc_work.

Fix by using proto_lock to guard l2cap_data, in addition to hdev->lock which is held in other access paths.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from ab4eedb790cae44313759b50fe47da285e2519d5 to b495a3a9b33bc4e4613e685bf5c96c136caa22d8 (excl.)
  • affected from ab4eedb790cae44313759b50fe47da285e2519d5 to 2b66c83ff1751d6bd3201b3017206262ab46dc05 (excl.)
  • Version efc30877bd4bc85fefe98d80af60fafc86e5775e is affected
  • Version f87271d21dd4ee83857ca11b94e7b4952749bbae is affected
  • Version 18ab6b6078fa8191ca30a3065d57bf35d5635761 is affected
  • affected from 6.6.84 to 6.7 (excl.)
  • affected from 6.12.20 to 6.13 (excl.)
  • affected from 6.13.8 to 6.14 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.14 is affected
  • unaffected from 0 to 6.14 (excl.)
  • unaffected from 7.2.6 to 7.2.* (incl.)
  • unaffected from 7.3-rc1 to * (incl.)

References