CVE-2026-90093

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth L2CAP implementation where l2cap chan::conn retains a reference and remains non-NULL even after the associated hci conn is deleted. Accessing fields such as hci conn::hdev in this state is invalid, which can lead to a KASAN crash during the execution of the l2cap sock setsockopt() function when accessing conn->hcon->hdev. This occurs due to a lack of verification that l2cap chan::conn.hcon corresponds to an active hci conn and a failure to hold l2cap chan lock() in getsockopt and setsockopt, resulting in data races within l2cap chan fields.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.