GHSA-XGWM-WPG9-2232
Vulnerability from github – Published: 2026-09-17 18:31 – Updated: 2026-09-18 18:31In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
For L2CAP sockets without owning sk->sk_socket, reading l2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() -> l2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks, but access in l2cap_sock_cleanup_listen() has unsafe lockless read.
[Task 1] [Task 2 (hdev->workqueue)] l2cap_sock_release(parent) l2cap_disconn_cfm l2cap_sock_cleanup_listen l2cap_conn_del bt_accept_dequeue l2cap_chan_del lock_sock(sk) l2cap_sock_teardown_cb bt_accept_unlink bt_sk(sk)->parent = NULL release_sock(sk) ----------------> lock_sock(sk) parent = / NULL / lock_sock(sk) <--------------------- release_sock(sk) sock_set_flag(sk, SOCK_ZAPPED) l2cap_sock_close_cb l2cap_sock_kill(sk) l2cap_sock_put_chan chan = READ l2cap_pi(sk)->chan l2cap_pi(sk)->chan = NULL l2cap_chan_hold_unless_zero l2cap_put_chan(chan) kref_get_unless_zero(&chan->ref)
Task 1 may observe NULL which causes null-ptr-deref.
Fix the race by taking lock_sock() in l2cap_sock_kill() to synchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not needed here, l2cap_pi(sk)->chan owns reference if it is non-NULL.
Clarify code comments vs. locking.
{
"affected": [],
"aliases": [
"CVE-2026-90091"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:17:00Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan\n\nFor L2CAP sockets without owning sk-\u003esk_socket, reading\nl2cap_pi(sk)-\u003echan may race against concurrent l2cap_sock_kill() -\u003e\nl2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks,\nbut access in l2cap_sock_cleanup_listen() has unsafe lockless read.\n\n [Task 1] [Task 2 (hdev-\u003eworkqueue)]\n l2cap_sock_release(parent) l2cap_disconn_cfm\n l2cap_sock_cleanup_listen l2cap_conn_del\n bt_accept_dequeue l2cap_chan_del\n lock_sock(sk) l2cap_sock_teardown_cb\n bt_accept_unlink\n bt_sk(sk)-\u003eparent = NULL\n release_sock(sk) ----------------\u003e lock_sock(sk)\n parent = /* NULL */\n lock_sock(sk) \u003c--------------------- release_sock(sk)\n sock_set_flag(sk, SOCK_ZAPPED)\n l2cap_sock_close_cb\n l2cap_sock_kill(sk)\n l2cap_sock_put_chan\n chan = READ l2cap_pi(sk)-\u003echan l2cap_pi(sk)-\u003echan = NULL\n l2cap_chan_hold_unless_zero l2cap_put_chan(chan)\n kref_get_unless_zero(\u0026chan-\u003eref)\n\nTask 1 may observe NULL which causes null-ptr-deref.\n\nFix the race by taking lock_sock() in l2cap_sock_kill() to\nsynchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not\nneeded here, l2cap_pi(sk)-\u003echan owns reference if it is non-NULL.\n\nClarify code comments vs. locking.",
"id": "GHSA-xgwm-wpg9-2232",
"modified": "2026-09-18T18:31:26Z",
"published": "2026-09-17T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90091"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.