CVE-2026-90091 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and security teams should assess exposure and apply the patch to fix the vulnerability. They should also verify that Linux kernel systems are running with the latest security updates and monitor systems for potential exploitation attempts. Additionally, they should review the Linux kernel's Bluetooth L2CAP subsystem to identify potential vulnerabilities and implement compensating controls for exposed systems.

Why it matters

The Linux kernel's Bluetooth L2CAP subsystem is vulnerable to a race condition that can lead to a null-pointer dereference. Linux kernel developers and administrators should assess exposure and apply the patch to fix the vulnerability.

• Verify Linux kernel systems for potential exploitation attempts
• Apply patches to fix the race condition vulnerability
• Monitor Linux kernel systems for null-pointer dereferences

Technical summary

The Linux kernel's Bluetooth L2CAP subsystem is vulnerable to a race condition that can lead to a null-pointer dereference. The vulnerability is caused by a lockless read in the l2cap_sock_cleanup_listen() function, which can race against concurrent l2cap_sock_kill() and l2cap_sock_put_chan() calls. This can result in a null-pointer dereference when accessing the l2cap_pi(sk)->chan field. The vulnerability affects Linux kernel systems and could lead to a denial-of-service or potentially allow an attacker to execute arbitrary code.

Defensive priority

High

Recommended defensive actions

• Review and apply the Linux kernel patch to fix the race condition vulnerability
• Monitor Linux kernel systems for potential exploitation attempts
• Verify that Linux kernel systems are running with the latest security updates
• Perform a thorough review of the Linux kernel's Bluetooth L2CAP subsystem to identify potential vulnerabilities
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is described in the Linux kernel's official repository. The CVE record and NVD entry provide additional information about the vulnerability. Linux kernel developers and administrators should verify the patch and assess exposure to ensure system security. The vulnerability affects Linux kernel systems and could lead to a null-pointer dereference. Evidence of the vulnerability's existence is limited to the provided CVE record and NVD entry.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.