{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN  New sk should not be added to parent socket accept queue after last l2cap_sock_cleanup_listen() has run in l2cap_sock_teardown_cb() and state set to BT_CLOSED, as that can result to UAF on dereferencing the dangling parent reference.  l2cap_sock_new_connection_cb() may race with parent l2cap_chan teardown, due to chan-\u003estate accessed without consistent locking:    [Task 1]                           [Task 2]   l2cap_sock_release(parent)         l2cap_connect     l2cap_sock_shutdown                pchan = l2cap_global_chan_by_psm       l2cap_chan_lock(pchan)       l2cap_chan_close         l2cap_sock_teardown_cb           pchan-\u003estate = BT_CLOSED       l2cap_chan_unlock(pchan) ------\u003e l2cap_chan_lock(pchan)                                        l2cap_new_connection                                          l2cap_sock_new_connection_cb       l2cap_chan_lock(pchan) \u003c-------- l2cap_chan_unlock(pchan)       l2cap_sock_kill(parent)          /* bt_sk(sk)-\u003eparent dangling */  Fix by adding check for sk_state == BT_LISTEN after acquiring sk lock in l2cap_sock_new_connection_cb().  Add lock_sock() around sk_state writes where missing, to avoid data races.  Although the data races on pchan-\u003estate should be fixed too, this defensive sk_state check probably makes sense in any case.",
  "id": "DEBIAN-CVE-2026-90092",
  "modified": "2026-09-18T04:47:35.767285623Z",
  "published": "2026-09-17T17:17:00.757Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-90092"
    }
  ],
  "upstream": [
    "CVE-2026-90092"
  ]
}