CVE-2026-90093 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan-conn safely in get/setsockopt Since commit b66774b48dd9 "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref" l2capchan::conn has held reference and remains non-NULL also after the...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from accessing l2capchan::conn in Bluetooth L2CAP’s get/setsockopt function. No checks are performed to ensure that the hciconn is still alive and that there is no lock held on it. This could lead to KASAN crashes and data...