{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-90091",
  "modified": "2026-10-07T14:35:31Z",
  "upstream": [
    "CVE-2026-90091"
  ],
  "published": "2026-09-17T16:10:40Z",
  "summary": "Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan\n\nFor L2CAP sockets without owning sk->sk_socket, reading\nl2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() ->\nl2cap_sock_put_chan().  This excludes simultaneous proto_ops callbacks,\nbut access in l2cap_sock_cleanup_listen() has unsafe lockless read.\n\n [Task 1]                         [Task 2 (hdev->workqueue)]\n l2cap_sock_release(parent)       l2cap_disconn_cfm\n   l2cap_sock_cleanup_listen        l2cap_conn_del\n     bt_accept_dequeue                l2cap_chan_del\n       lock_sock(sk)                    l2cap_sock_teardown_cb\n       bt_accept_unlink\n         bt_sk(sk)->parent = NULL\n       release_sock(sk) ----------------> lock_sock(sk)\n                                          parent = /* NULL */\n     lock_sock(sk) <--------------------- release_sock(sk)\n                                          sock_set_flag(sk, SOCK_ZAPPED)\n                                      l2cap_sock_close_cb\n                                        l2cap_sock_kill(sk)\n                                          l2cap_sock_put_chan\n     chan = READ l2cap_pi(sk)->chan         l2cap_pi(sk)->chan = NULL\n     l2cap_chan_hold_unless_zero            l2cap_put_chan(chan)\n       kref_get_unless_zero(&chan->ref)\n\nTask 1 may observe NULL which causes null-ptr-deref.\n\nFix the race by taking lock_sock() in l2cap_sock_kill() to\nsynchronize with l2cap_sock_cleanup_listen().  hold_unless_zero() is not\nneeded here, l2cap_pi(sk)->chan owns reference if it is non-NULL.\n\nClarify code comments vs. locking.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.12.109-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.12.109+rpt-rpi-2712",
            "binary_version": "1:6.12.109-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.109+rpt-rpi-v6",
            "binary_version": "1:6.12.109-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.109+rpt-rpi-v7",
            "binary_version": "1:6.12.109-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.109+rpt-rpi-v7l",
            "binary_version": "1:6.12.109-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.109+rpt-rpi-v8",
            "binary_version": "1:6.12.109-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.109+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.109-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.12.109-1+rpt1": {
            "linux_commit": "7d1826930811232688a50c99c540fbb137aed081",
            "upstream_version": "6.12.109",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.110"
          }
        }
      }
    },
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:13",
        "name": "linux"
      },
      "versions": [
        "1:6.18.50-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.18.50+rpt-rpi-2712",
            "binary_version": "1:6.18.50-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.50+rpt-rpi-v6",
            "binary_version": "1:6.18.50-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.50+rpt-rpi-v7",
            "binary_version": "1:6.18.50-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.50+rpt-rpi-v8",
            "binary_version": "1:6.18.50-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.50+rpt-rpi-v8-rt",
            "binary_version": "1:6.18.50-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.18.50-1+rpt1": {
            "linux_commit": "cff533aec2fa601846766b32ff57204e0a61bed7",
            "upstream_version": "6.18.50",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.18.52"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90091"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-18T17:55:42Z"
  }
}