{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "b39298044e5534612511a2ff5de03ba5f6e7a820"
            },
            {
              "fixed": "827de6bd2865b22aaabd554540def3b8a33018ab"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "8c37e4338c801ebb8cee52436c01c41e009f6e87"
            },
            {
              "fixed": "7c7ac736b50fa259ed1bdddc18d79523f07c0442"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "84e718b6a814edc84159361f9f454a4e92ae91ae"
            },
            {
              "fixed": "4f8c63fe0097c9f6ea34409f82f79b3894903d91"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "36da806f7fbaee56ad9e81859deec203f9728700"
            },
            {
              "fixed": "61d5ddbd524c715b224cbe7e9f01da4e05098b19"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6fef032af0092ed5ccb767239a9ac1bc38c08a40"
            },
            {
              "fixed": "32a7bc6e93be36b37fe61f351d312d358195bd61"
            },
            {
              "fixed": "66d6ef18548ae6d7dd452b84115fc82c0a73a4ea"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "733e76e74e406c1d1ddc7369420dd8a47f48bb8a"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.1.178"
            },
            {
              "fixed": "6.1.188"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.6.145"
            },
            {
              "fixed": "6.6.157"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.12.97"
            },
            {
              "fixed": "6.12.110"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.18.40"
            },
            {
              "fixed": "6.18.52"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "7.1.5"
            },
            {
              "fixed": "7.2"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.188"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.157"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.110"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.52"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90091.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan\n\nFor L2CAP sockets without owning sk-\u003esk_socket, reading\nl2cap_pi(sk)-\u003echan may race against concurrent l2cap_sock_kill() -\u003e\nl2cap_sock_put_chan().  This excludes simultaneous proto_ops callbacks,\nbut access in l2cap_sock_cleanup_listen() has unsafe lockless read.\n\n [Task 1]                         [Task 2 (hdev-\u003eworkqueue)]\n l2cap_sock_release(parent)       l2cap_disconn_cfm\n   l2cap_sock_cleanup_listen        l2cap_conn_del\n     bt_accept_dequeue                l2cap_chan_del\n       lock_sock(sk)                    l2cap_sock_teardown_cb\n       bt_accept_unlink\n         bt_sk(sk)-\u003eparent = NULL\n       release_sock(sk) ----------------\u003e lock_sock(sk)\n                                          parent = /* NULL */\n     lock_sock(sk) \u003c--------------------- release_sock(sk)\n                                          sock_set_flag(sk, SOCK_ZAPPED)\n                                      l2cap_sock_close_cb\n                                        l2cap_sock_kill(sk)\n                                          l2cap_sock_put_chan\n     chan = READ l2cap_pi(sk)-\u003echan         l2cap_pi(sk)-\u003echan = NULL\n     l2cap_chan_hold_unless_zero            l2cap_put_chan(chan)\n       kref_get_unless_zero(\u0026chan-\u003eref)\n\nTask 1 may observe NULL which causes null-ptr-deref.\n\nFix the race by taking lock_sock() in l2cap_sock_kill() to\nsynchronize with l2cap_sock_cleanup_listen().  hold_unless_zero() is not\nneeded here, l2cap_pi(sk)-\u003echan owns reference if it is non-NULL.\n\nClarify code comments vs. locking.",
  "id": "CVE-2026-90091",
  "modified": "2026-09-19T03:30:44.825020651Z",
  "published": "2026-09-17T16:06:05.478Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90091.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90091"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan"
}