CVE-2026-90092

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the Bluetooth L2CAP implementation. The problem occurs because a new socket may be added to the parent socket accept queue after the l2cap sock cleanup listen() function has executed within l2cap sock teardown cb() and the state has been set to BT CLOSED. This happens due to a race condition in the l2cap sock new connection cb() function during parent l2cap chan teardown, caused by inconsistent locking when accessing chan->state. This can lead to the dereferencing of a dangling parent reference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.