In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt Since commit… (CVE-2026-90093)
A high-severity vulnerability in the Linux kernel's Bluetooth L2CAP subsystem was resolved. The issue involved unsafe access to the l2cap_chan::conn pointer in get/setsockopt operations, which could lead to kernel crashes due to use-after-free conditions. The fix ensures proper reference holding and locking to prevent invalid memory access and data races.
AI Analysis
Technical Summary
CVE-2026-90093 addresses a use-after-free vulnerability in the Linux kernel Bluetooth L2CAP code. The l2cap_chan::conn pointer was accessed unsafely in l2cap_sock_setsockopt(), potentially leading to kernel address sanitizer (KASAN) crashes when the underlying hci_conn was deleted but the reference remained. The patch introduced holding a reference to l2cap_chan::conn and acquiring l2cap_chan_lock() during getsockopt/setsockopt calls to ensure the connection remains valid and to prevent data races on l2cap_chan fields.
Potential Impact
Exploitation of this vulnerability could cause kernel crashes and potentially allow an attacker with local privileges to escalate impact to confidentiality, integrity, and availability of the system due to the high CVSS score (7.8) indicating high impact on all three security properties. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel since commit b66774b48dd9. Users and administrators should update to a Linux kernel version that includes this commit or later to remediate the vulnerability. No additional mitigations are indicated beyond applying the official patch.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt Since commit… (CVE-2026-90093)
Description
A high-severity vulnerability in the Linux kernel's Bluetooth L2CAP subsystem was resolved. The issue involved unsafe access to the l2cap_chan::conn pointer in get/setsockopt operations, which could lead to kernel crashes due to use-after-free conditions. The fix ensures proper reference holding and locking to prevent invalid memory access and data races.
CVSS v3.1
Score 7.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90093 addresses a use-after-free vulnerability in the Linux kernel Bluetooth L2CAP code. The l2cap_chan::conn pointer was accessed unsafely in l2cap_sock_setsockopt(), potentially leading to kernel address sanitizer (KASAN) crashes when the underlying hci_conn was deleted but the reference remained. The patch introduced holding a reference to l2cap_chan::conn and acquiring l2cap_chan_lock() during getsockopt/setsockopt calls to ensure the connection remains valid and to prevent data races on l2cap_chan fields.
Potential Impact
Exploitation of this vulnerability could cause kernel crashes and potentially allow an attacker with local privileges to escalate impact to confidentiality, integrity, and availability of the system due to the high CVSS score (7.8) indicating high impact on all three security properties. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel since commit b66774b48dd9. Users and administrators should update to a Linux kernel version that includes this commit or later to remediate the vulnerability. No additional mitigations are indicated beyond applying the official patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vcch-q6jx-pg5j
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90093"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aade52855bf5e2cf5edc1c9
Added to database: 09/19/2026, 01:28:08 UTC
Last enriched: 09/19/2026, 01:54:28 UTC
Last updated: 09/19/2026, 03:32:50 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.