---
id: CVE-2026-90093
title: >-
  In the Linux kernel, the following vulnerability has been resolved:


  Bluetooth: L2CAP: access chan->conn safely in get/setsockopt


  Since commit b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by
  holding conn ref")

  l2cap_chan:…
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  Bluetooth: L2CAP: access chan->conn safely in get/setsockopt


  Since commit b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by
  holding conn ref")

  l2cap_chan:…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b66774b48dd98f07254951f74ea6f513efe7ff8b <
    f49321c85785178214fd67f2e9b4b73d6363783b
  - >-
    Linux >= b66774b48dd98f07254951f74ea6f513efe7ff8b <
    ca2c4c26498643f421d35ffe258fafbd3ed461c3
  - Linux 8f90405a4a6f1f1880dc07996b47bf57c712bd8a
  - Linux 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b
  - Linux 8922c7940bae9ce4b1736dddb6362370793835c2
  - Linux 91047a4396a8b1857a6f712a90cf33ec0012b189
  - Linux 0b0e2bf39cf99e458d991b9df253727e036a7d7d
  - Linux d3b739db5dc6f688a60d56da872fabaf65246032
  - Linux 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277
  - Linux >= 5.10.265 < 5.11
  - Linux >= 5.15.216 < 5.16
  - Linux >= 6.1.183 < 6.2
  - Linux >= 6.6.145 < 6.7
  - Linux >= 6.12.97 < 6.13
  - Linux >= 6.18.39 < 6.19
  - Linux >= 7.1.4 < 7.2
  - Linux 7.2
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:41.697'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90093'
references:
  - url: 'https://git.kernel.org/stable/c/ca2c4c26498643f421d35ffe258fafbd3ed461c3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f49321c85785178214fd67f2e9b4b73d6363783b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00165
epssPercentile: 0.0504
ingestedAt: '2026-09-17T16:21:47.892Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

Since commit b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref")
l2cap_chan::conn has held reference and remains non-NULL also after the
corresponding hci_conn is deleted.  In this state accessing various
fields eg. hci_conn::hdev is invalid, which leads to KASAN crash in
l2cap_sock_setsockopt() access of conn->hcon->hdev.

Check l2cap_chan::conn.hcon corresponds to an alive hci_conn before
trying to use it in l2cap_sock.c.  Hold l2cap_chan_lock() in
getsockopt/setsockopt to ensure it stays alive, and to avoid data races
in l2cap_chan fields.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.