8.8

CVE-2026-90256

Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind

hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via
hci_conn_timeout (disc_work) -> hci_proto_disconn_ind ->
l2cap_disconn_ind.  This is UAF if the l2cap_conn is deleted
concurrently.

disc_work is disabled sync in hci_conn_del(), so we cannot take
hci_dev_lock in disc_work.

Fix by using proto_lock to guard l2cap_data, in addition to hdev->lock
which is held in other access paths.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version ab4eedb790cae44313759b50fe47da285e2519d5
Version < b495a3a9b33bc4e4613e685bf5c96c136caa22d8
Status affected
Version ab4eedb790cae44313759b50fe47da285e2519d5
Version < 2b66c83ff1751d6bd3201b3017206262ab46dc05
Status affected
Version efc30877bd4bc85fefe98d80af60fafc86e5775e
Status affected
Version f87271d21dd4ee83857ca11b94e7b4952749bbae
Status affected
Version 18ab6b6078fa8191ca30a3065d57bf35d5635761
Status affected
Version 6.6.84
Version < 6.7
Status affected
Version 6.12.20
Version < 6.13
Status affected
Version 6.13.8
Version < 6.14
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.14
Status affected
Version 0
Version < 6.14
Status unaffected
Version <= 7.2.*
Version 7.2.6
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.217
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/b495a3a9b33bc4e4613e685bf5c96c136caa22d8
https://git.kernel.org/stable/c/2b66c83ff1751d6bd3201b3017206262ab46dc05