CVE-2026-90092 addresses a use-after-free vulnerability in the Linux kernel Bluetooth L2CAP layer. The issue arises when a new socket is added to the parent socket's accept queue after the parent has been cleaned up and its state set to BT_CLOSED, resulting in a dangling pointer dereference. The root cause is a race condition between l2cap_sock_new_connection_cb() and the parent channel teardown, where the channel state is accessed without consistent locking. The fix involves adding a check for sk_state == BT_LISTEN after acquiring the socket lock in l2cap_sock_new_connection_cb(), and adding lock_sock() calls around sk_state writes to prevent data races.

Successful exploitation could lead to use-after-free conditions causing kernel memory corruption, potentially resulting in privilege escalation, denial of service, or arbitrary code execution within the kernel context. The CVSS v3.1 score is 8.0 (High), reflecting the significant confidentiality, integrity, and availability impacts.

A fix has been implemented in the Linux kernel to address this vulnerability by adding proper state checks and locking mechanisms. Users should update their Linux kernel to a version that includes this patch. Since this is not a cloud service, remediation depends on applying the official kernel update. Patch status is confirmed as fixed in the vendor advisory.