CVE-2026-90256

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the Bluetooth L2CAP implementation. The l2cap data member of hci conn is accessed without proper locking within the l2cap disconn ind() function, which is reached via the hci conn timeout() (disc work) and hci proto disconn ind() path. This occurs because disc work is disabled synchronously in hci conn del(), preventing the use of hci dev lock. A Use-After-Free occurs if the l2cap conn is deleted concurrently with this access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.