CVE-2026-90091
Estado: RecibidaAlta (8)—
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
For L2CAP sockets without owning sk->sk_socket, reading l2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() -> l2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks, but access in l2cap_sock_cleanup_listen() has unsafe lockless read.
Task 1 may observe NULL which causes null-ptr-deref.
Fix the race by taking lock_sock() in l2cap_sock_kill() to synchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not needed here, l2cap_pi(sk)->chan owns reference if it is non-NULL.
Leer descripción completaMostrar menos
Clarify code comments vs. locking.
Detalles técnicos trazas, registros y código del informe original
[Task 1] [Task 2 (hdev->workqueue)]
l2cap_sock_release(parent) l2cap_disconn_cfm
l2cap_sock_cleanup_listen l2cap_conn_del
bt_accept_dequeue l2cap_chan_del
lock_sock(sk) l2cap_sock_teardown_cb
bt_accept_unlink
bt_sk(sk)->parent = NULL
release_sock(sk) ----------------> lock_sock(sk)
parent = /* NULL */
lock_sock(sk) <--------------------- release_sock(sk)
sock_set_flag(sk, SOCK_ZAPPED)
l2cap_sock_close_cb
l2cap_sock_kill(sk)
l2cap_sock_put_chan
chan = READ l2cap_pi(sk)->chan l2cap_pi(sk)->chan = NULL
l2cap_chan_hold_unless_zero l2cap_put_chan(chan)
kref_get_unless_zero(&chan->ref)CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.41%
- Percentil entre todas las CVEs puntuadas: 34
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1210Exploitation of Remote Serviceslateral movement65 % - Impacto principal
T1499.004Application or System Exploitationimpact55 %
Explotación corregida por reglas (vector CVSS): era T1068
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
- https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61
- https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91
- https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19
- https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea
- https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442
- https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-90091",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.1
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "b39298044e5534612511a2ff5de03ba5f6e7a820",
"lessThan": "827de6bd2865b22aaabd554540def3b8a33018ab",
"versionType": "git"
},
{
"status": "affected",
"version": "8c37e4338c801ebb8cee52436c01c41e009f6e87",
"lessThan": "7c7ac736b50fa259ed1bdddc18d79523f07c0442",
"versionType": "git"
},
{
"status": "affected",
"version": "84e718b6a814edc84159361f9f454a4e92ae91ae",
"lessThan": "4f8c63fe0097c9f6ea34409f82f79b3894903d91",
"versionType": "git"
},
{
"status": "affected",
"version": "36da806f7fbaee56ad9e81859deec203f9728700",
"lessThan": "61d5ddbd524c715b224cbe7e9f01da4e05098b19",
"versionType": "git"
},
{
"status": "affected",
"version": "6fef032af0092ed5ccb767239a9ac1bc38c08a40",
"lessThan": "32a7bc6e93be36b37fe61f351d312d358195bd61",
"versionType": "git"
},
{
"status": "affected",
"version": "6fef032af0092ed5ccb767239a9ac1bc38c08a40",
"lessThan": "66d6ef18548ae6d7dd452b84115fc82c0a73a4ea",
"versionType": "git"
},
{
"status": "affected",
"version": "733e76e74e406c1d1ddc7369420dd8a47f48bb8a",
"versionType": "git"
},
{
"status": "affected",
"version": "6.1.178",
"lessThan": "6.1.188",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.145",
"lessThan": "6.6.157",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.97",
"lessThan": "6.12.110",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.40",
"lessThan": "6.18.52",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.1.5",
"lessThan": "7.2",
"versionType": "semver"
}
],
"programFiles": [
"include/net/bluetooth/l2cap.h",
"net/bluetooth/l2cap_sock.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/bluetooth/l2cap.h",
"net/bluetooth/l2cap_sock.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-17T17:17:00.563",
"references": [
{
"url": "https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan\n\nFor L2CAP sockets without owning sk->sk_socket, reading\nl2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() ->\nl2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks,\nbut access in l2cap_sock_cleanup_listen() has unsafe lockless read.\n\n [Task 1] [Task 2 (hdev->workqueue)]\n l2cap_sock_release(parent) l2cap_disconn_cfm\n l2cap_sock_cleanup_listen l2cap_conn_del\n bt_accept_dequeue l2cap_chan_del\n lock_sock(sk) l2cap_sock_teardown_cb\n bt_accept_unlink\n bt_sk(sk)->parent = NULL\n release_sock(sk) ----------------> lock_sock(sk)\n parent = /* NULL */\n lock_sock(sk) <--------------------- release_sock(sk)\n sock_set_flag(sk, SOCK_ZAPPED)\n l2cap_sock_close_cb\n l2cap_sock_kill(sk)\n l2cap_sock_put_chan\n chan = READ l2cap_pi(sk)->chan l2cap_pi(sk)->chan = NULL\n l2cap_chan_hold_unless_zero l2cap_put_chan(chan)\n kref_get_unless_zero(&chan->ref)\n\nTask 1 may observe NULL which causes null-ptr-deref.\n\nFix the race by taking lock_sock() in l2cap_sock_kill() to\nsynchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not\nneeded here, l2cap_pi(sk)->chan owns reference if it is non-NULL.\n\nClarify code comments vs. locking."
}
],
"lastModified": "2026-09-18T18:17:41.277",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}