CVE-2026-90256
High
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via hci_conn_timeout (disc_work) -> hci_proto_disconn_ind -> l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted concurrently. disc_work is disabled sync in hci_conn_del(), so we cannot take hci_dev_lock in disc_work. Fix by using proto_lock to guard l2cap_data, in addition to hdev->lock which is held in other access paths.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Linux
PublishedSep 17, 2026
First seenSep 17, 2026
How to fix
Update
- Linux Linux0fa448369c87e20b2aeaeaca0187d698dd61f791, 7c032b6d48a46634cbd58aaebad2638c00ad3b51, b495a3a9b33bc4e4613e685bf5c96c136caa22d8, 2b66c83ff1751d6bd3201b3017206262ab46dc05, 6.6.160, 6.12.114, 6.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | efc30877bd4bc85fefe98d80af60fafc86e5775e ≤ v < 0fa448369c87e20b2aeaeaca0187d698dd61f791, f87271d21dd4ee83857ca11b94e7b4952749bbae ≤ v < 7c032b6d48a46634cbd58aaebad2638c00ad3b51, ab4eedb790cae44313759b50fe47da285e2519d5 ≤ v < b495a3a9b33bc4e4613e685bf5c96c136caa22d8, ab4eedb790cae44313759b50fe47da285e2519d5 ≤ v < 2b66c83ff1751d6bd3201b3017206262ab46dc05, 18ab6b6078fa8191ca30a3065d57bf35d5635761, 6.6.84 ≤ v < 6.6.160, 6.12.20 ≤ v < 6.12.114, 6.13.8 ≤ v < 6.14, 6.14 | 0fa448369c87e20b2aeaeaca0187d698dd61f791, 7c032b6d48a46634cbd58aaebad2638c00ad3b51, b495a3a9b33bc4e4613e685bf5c96c136caa22d8, 2b66c83ff1751d6bd3201b3017206262ab46dc05, 6.6.160, 6.12.114, 6.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.