CVE-2026-90093

A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component. This vulnerability allows for a Use-After-Free (UAF) condition when handling getsockopt and setsockopt operations. An attacker could exploit this by causing the system to attempt to access freed memory, leading to a Kernel Address Sanitizer (KASAN) crash and a denial of service.

A race in the Bluetooth L2CAP socket option paths can access chan conn after the associated hci_conn has already been deleted. The retained chan conn reference can remain non NULL while conn hcon and fields such as hdev are no longer valid, resulting in a KASAN detected use after free access and a possible kernel crash. For the CVSS the PR:L reflects that a local user or process must normally create or operate an L2CAP socket and invoke getsockopt or setsockopt during connection teardown. AC:H is appropriate because reliable triggering depends on winning a timing window between socket option processing and connection deletion. A remote Bluetooth peer may influence disconnect timing, but the peer alone cannot directly issue the required local socket option calls, so the vulnerability is not classified as directly network reachable. Impact is at least local denial of service through a kernel crash. In the paranoid interpretation the stale object access may also cause limited confidentiality or integrity impact if freed memory is reused, but no reliable arbitrary write or privilege escalation primitive is established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.