7.8

CVE-2026-90093

Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

Since commit b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref")
l2cap_chan::conn has held reference and remains non-NULL also after the
corresponding hci_conn is deleted.  In this state accessing various
fields eg. hci_conn::hdev is invalid, which leads to KASAN crash in
l2cap_sock_setsockopt() access of conn->hcon->hdev.

Check l2cap_chan::conn.hcon corresponds to an alive hci_conn before
trying to use it in l2cap_sock.c.  Hold l2cap_chan_lock() in
getsockopt/setsockopt to ensure it stays alive, and to avoid data races
in l2cap_chan fields.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version b66774b48dd98f07254951f74ea6f513efe7ff8b
Version < f49321c85785178214fd67f2e9b4b73d6363783b
Status affected
Version b66774b48dd98f07254951f74ea6f513efe7ff8b
Version < ca2c4c26498643f421d35ffe258fafbd3ed461c3
Status affected
Version 8f90405a4a6f1f1880dc07996b47bf57c712bd8a
Status affected
Version 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b
Status affected
Version 8922c7940bae9ce4b1736dddb6362370793835c2
Status affected
Version 91047a4396a8b1857a6f712a90cf33ec0012b189
Status affected
Version 0b0e2bf39cf99e458d991b9df253727e036a7d7d
Status affected
Version d3b739db5dc6f688a60d56da872fabaf65246032
Status affected
Version 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277
Status affected
Version 5.10.265
Version < 5.11
Status affected
Version 5.15.216
Version < 5.16
Status affected
Version 6.1.183
Version < 6.2
Status affected
Version 6.6.145
Version < 6.7
Status affected
Version 6.12.97
Version < 6.13
Status affected
Version 6.18.39
Version < 6.19
Status affected
Version 7.1.4
Version < 7.2
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 7.2
Status affected
Version 0
Version < 7.2
Status unaffected
Version <= 7.2.*
Version 7.2.6
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.15% 0.049
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/f49321c85785178214fd67f2e9b4b73d6363783b
https://git.kernel.org/stable/c/ca2c4c26498643f421d35ffe258fafbd3ed461c3