CVE-2026-90093
Estado: RecibidaAlta (7.8)—
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
Since commit b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") l2cap_chan::conn has held reference and remains non-NULL also after the corresponding hci_conn is deleted. In this state accessing various fields eg. hci_conn::hdev is invalid, which leads to KASAN crash in l2cap_sock_setsockopt() access of conn->hcon->hdev.
Check l2cap_chan::conn.hcon corresponds to an alive hci_conn before trying to use it in l2cap_sock.c. Hold l2cap_chan_lock() in getsockopt/setsockopt to ensure it stays alive, and to avoid data races in l2cap_chan fields.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.17%
- Percentil entre todas las CVEs puntuadas: 5
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1068Exploitation for Privilege Escalationprivilege escalation60 %
Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-90093",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "b66774b48dd98f07254951f74ea6f513efe7ff8b",
"lessThan": "f49321c85785178214fd67f2e9b4b73d6363783b",
"versionType": "git"
},
{
"status": "affected",
"version": "b66774b48dd98f07254951f74ea6f513efe7ff8b",
"lessThan": "ca2c4c26498643f421d35ffe258fafbd3ed461c3",
"versionType": "git"
},
{
"status": "affected",
"version": "8f90405a4a6f1f1880dc07996b47bf57c712bd8a",
"versionType": "git"
},
{
"status": "affected",
"version": "32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b",
"versionType": "git"
},
{
"status": "affected",
"version": "8922c7940bae9ce4b1736dddb6362370793835c2",
"versionType": "git"
},
{
"status": "affected",
"version": "91047a4396a8b1857a6f712a90cf33ec0012b189",
"versionType": "git"
},
{
"status": "affected",
"version": "0b0e2bf39cf99e458d991b9df253727e036a7d7d",
"versionType": "git"
},
{
"status": "affected",
"version": "d3b739db5dc6f688a60d56da872fabaf65246032",
"versionType": "git"
},
{
"status": "affected",
"version": "50c38d9f42a529691e4e67ea9cedf4f0bfc8d277",
"versionType": "git"
},
{
"status": "affected",
"version": "5.10.265",
"lessThan": "5.11",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.216",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.183",
"lessThan": "6.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.145",
"lessThan": "6.7",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.97",
"lessThan": "6.13",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.39",
"lessThan": "6.19",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.1.4",
"lessThan": "7.2",
"versionType": "semver"
}
],
"programFiles": [
"net/bluetooth/l2cap_sock.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/bluetooth/l2cap_sock.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-17T17:17:00.900",
"references": [
{
"url": "https://git.kernel.org/stable/c/ca2c4c26498643f421d35ffe258fafbd3ed461c3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f49321c85785178214fd67f2e9b4b73d6363783b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: access chan->conn safely in get/setsockopt\n\nSince commit b66774b48dd9 (\"Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\")\nl2cap_chan::conn has held reference and remains non-NULL also after the\ncorresponding hci_conn is deleted. In this state accessing various\nfields eg. hci_conn::hdev is invalid, which leads to KASAN crash in\nl2cap_sock_setsockopt() access of conn->hcon->hdev.\n\nCheck l2cap_chan::conn.hcon corresponds to an alive hci_conn before\ntrying to use it in l2cap_sock.c. Hold l2cap_chan_lock() in\ngetsockopt/setsockopt to ensure it stays alive, and to avoid data races\nin l2cap_chan fields."
}
],
"lastModified": "2026-09-18T18:17:41.697",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}