Cloudanix VulnDB

CVE-2026-90256

High · 8.8

CVSS

8.8

EPSS

0.4%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in Linux Bluetooth connection handling could let a nearby attacker crash the system or potentially run harmful code.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in L2CAP disconnection handling where l2cap_disconn_ind accesses hci_conn::l2cap_data without proto_lock, allowing concurrent deletion of l2cap_conn via disc_work in hci_conn_timeout.

Why it matters to the business

Remote code execution or system crashes possible on Linux devices with Bluetooth enabled, increasing risk of data compromise or service disruption until patched.

How an attack unfolds

An attacker in Bluetooth range sends packets to force disconnection, racing disc_work against l2cap_conn deletion to trigger the unlocked access and UAF in l2cap_disconn_ind.

How to fix it

Apply the upstream kernel commit that adds proto_lock guarding around l2cap_data accesses in addition to existing hdev lock usage; rebuild and deploy updated kernels to affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting l2cap_disconn_ind for proto_lock usage, then verify running kernel version incorporates the fix and test Bluetooth disconnection paths under load.

Typical attack path

  1. Establish proximity to target Bluetooth interface
  2. Transmit crafted L2CAP packets to initiate disconnection sequence
  3. Exploit race condition between disc_work and concurrent l2cap_conn deletion to access freed memory

How to detect it

Review kernel logs and dmesg for use-after-free warnings or crashes involving l2cap or hci_conn_timeout; inspect Bluetooth traces for unexpected disconnection indications.

What your security team should do

  • Disable Bluetooth interfaces where not required to reduce attack surface
  • Prioritize kernel updates containing the proto_lock fix across all Linux distributions
  • Monitor kernel logs and Bluetooth stack activity for anomalous disconnection events

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via hci_conn_timeout (disc_work) -> hci_proto_disconn_ind -> l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted concurrently. disc_work is disabled sync in hci_conn_del(), so we cannot take hci_dev_lock in disc_work. Fix by using proto_lock to guard l2cap_data, in addition to hdev->lock which is held in other access paths.

Affected packages

Ecosystem Package Introduced Fixed