CVE-2026-90091

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the Bluetooth L2CAP implementation. For L2CAP sockets that do not own sk->sk socket, a lockless read of l2cap pi(sk)->chan within the l2cap sock cleanup listen() function can race against concurrent execution of l2cap sock kill() and l2cap sock put chan(). This synchronization failure can lead to a null-pointer dereference if the system observes a NULL value during the operation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.