{"id":"CVE-2026-90093","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: access chan->conn safely in get/setsockopt\n\nSince commit b66774b48dd9 (\"Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\")\nl2cap_chan:…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: access chan->conn safely in get/setsockopt\n\nSince commit b66774b48dd9 (\"Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\")\nl2cap_chan:…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= b66774b48dd98f07254951f74ea6f513efe7ff8b < f49321c85785178214fd67f2e9b4b73d6363783b","Linux >= b66774b48dd98f07254951f74ea6f513efe7ff8b < ca2c4c26498643f421d35ffe258fafbd3ed461c3","Linux 8f90405a4a6f1f1880dc07996b47bf57c712bd8a","Linux 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b","Linux 8922c7940bae9ce4b1736dddb6362370793835c2","Linux 91047a4396a8b1857a6f712a90cf33ec0012b189","Linux 0b0e2bf39cf99e458d991b9df253727e036a7d7d","Linux d3b739db5dc6f688a60d56da872fabaf65246032","Linux 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277","Linux >= 5.10.265 < 5.11","Linux >= 5.15.216 < 5.16","Linux >= 6.1.183 < 6.2","Linux >= 6.6.145 < 6.7","Linux >= 6.12.97 < 6.13","Linux >= 6.18.39 < 6.19","Linux >= 7.1.4 < 7.2","Linux 7.2"],"published":"2026-09-17","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:17:41.697","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90093","references":[{"url":"https://git.kernel.org/stable/c/ca2c4c26498643f421d35ffe258fafbd3ed461c3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f49321c85785178214fd67f2e9b4b73d6363783b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00154,"epssPercentile":0.04932,"ingestedAt":"2026-09-17T16:21:47.892Z","slug":"CVE-2026-90093","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: access chan->conn safely in get/setsockopt\n\nSince commit b66774b48dd9 (\"Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\")\nl2cap_chan::conn has held reference and remains non-NULL also after the\ncorresponding hci_conn is deleted.  In this state accessing various\nfields eg. hci_conn::hdev is invalid, which leads to KASAN crash in\nl2cap_sock_setsockopt() access of conn->hcon->hdev.\n\nCheck l2cap_chan::conn.hcon corresponds to an alive hci_conn before\ntrying to use it in l2cap_sock.c.  Hold l2cap_chan_lock() in\ngetsockopt/setsockopt to ensure it stays alive, and to avoid data races\nin l2cap_chan fields.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":207115,"id":"CVE-2026-90093","ts":1789757333191,"field":"cvss","old":null,"new":"7.8"},{"seq":207114,"id":"CVE-2026-90093","ts":1789757333191,"field":"severity","old":"none","new":"high"}]}