CVE-2026-90092

A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation. A race condition can occur when a new connection is established while a parent L2CAP channel is being torn down, due to inconsistent locking. This can lead to a Use-After-Free (UAF) vulnerability, where the system attempts to access memory that has already been deallocated. This could allow an attacker to cause a denial of service or potentially execute arbitrary code.

A race in the Bluetooth L2CAP socket path can allow l2cap_sock_new_connection_cb to add a new child socket after the parent listener has completed teardown and entered BT_CLOSED. The child socket may retain a dangling parent reference, and later dereferencing that reference can result in use after free and a kernel crash. A nearby Bluetooth peer may be able to trigger the race by initiating an L2CAP connection while the listening socket is being closed. For the CVSS the PR:N value is used because no account or local privileges on the target are required when the attacker can directly reach the exposed Bluetooth L2CAP service. AV:A is used because exploitation requires Bluetooth proximity or equivalent adjacent radio access rather than general Internet reachability. AC:H reflects the timing dependent race between connection creation and listener teardown. Impact is at least denial of service through a kernel crash. In the worst still defensible case, reuse of the freed socket object may affect confidentiality and integrity or potentially support privilege escalation, although a reliable arbitrary read or write primitive is not demonstrated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.