CVE-2026-90256
Description
A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component. A use-after-free (UAF) vulnerability can occur when hci_conn::l2cap_data is accessed without proper locking during the disconnection indication process. This can lead to a system crash or potentially allow an attacker to execute arbitrary code.
Statement
Bluetooth L2CAP can hit a use after free because hci_conn::l2cap_data is read in l2cap_disconn_ind without the same locking used when l2cap_conn is deleted. A nearby Bluetooth peer or a local actor able to drive Bluetooth connection and disconnection timing may trigger the race while disc_work is processing a disconnect indication, causing l2cap_disconn_ind to read conn disc_reason from a freed l2cap_conn. For the CVSS the PR:N is used for the paranoid score because an adjacent Bluetooth attacker does not need an account or local privileges on the victim if the affected Bluetooth path is reachable. The issue is not Internet routable and should be treated as adjacent network reachable rather than AV:N. Impact is at least denial of service via kernel warning or crash. In worst case it may allow limited confidentiality or integrity impact due to a kernel UAF read pattern and should be reviewed manually.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 8.8 |
| Attack Vector | Network | N/A | Adjacent Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
