PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-90093 Linux CVE debrief

A vulnerability in the Linux kernel's Bluetooth L2CAP has been resolved. The issue arises from accessing `chan->conn` safely in get/setsockopt. After a specific commit, `l2cap_chan::conn` holds a reference and remains non-NULL even after the corresponding `hci_conn` is deleted. However, accessing fields like `hci_conn::hdev` in this state is invalid, leading to a KASAN crash in `l2cap_sock_setsockopt()`. To fix this, a check is added to ensure `l2cap_chan::conn.hcon` corresponds to an alive `hci_conn` before using it in `l2cap_sock.c`. Additionally, `l2cap_chan_lock()` is held in getsockopt/setsockopt to ensure it stays alive and to avoid data races in `l2cap_chan` fields.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-17
Original CVE updated
2026-09-18
Advisory published
2026-09-17
Advisory updated
2026-09-18

Who should care

Defenders responsible for Linux kernel systems using Bluetooth L2CAP should assess exposure and prioritize patching. They should also monitor system logs and review kernel configurations.

Why it matters

Defenders should prioritize patching Linux kernel versions affected by this vulnerability to prevent potential KASAN crashes. They should also monitor system logs and review kernel configurations. The vulnerability's impact requires verification from official sources due to limited details on affected versions and exploitation.

  • Verify patch application to prevent potential KASAN crashes
  • Monitor system logs for signs of exploitation attempts
  • Review kernel configurations to ensure secure settings

Technical summary

The Linux kernel's Bluetooth L2CAP has a vulnerability that can lead to KASAN crashes due to accessing chan->conn safely in get/setsockopt. A fix has been implemented to check l2cap_chan::conn.hcon for alive hci_conn and hold l2cap_chan_lock() in getsockopt/setsockopt. Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those using Bluetooth L2CAP. They should also monitor system logs for potential KASAN crashes and review kernel configurations for secure settings. The vulnerability's impact requires verification from official sources due to limited details on affected versions and exploitation.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those using Bluetooth L2CAP. They should also monitor system logs for potential KASAN crashes and review kernel configurations for secure settings.

Recommended defensive actions

  • Verify and apply patches for Linux kernel versions affected by this vulnerability
  • Monitor system logs for potential KASAN crashes
  • Review kernel configurations for secure settings
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code changes. However, specific affected Linux kernel versions and exploitation details are not provided, requiring further verification.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-90093 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-90093

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-90093 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-90093

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ca2c4c26498643f421d35ffe258fafbd3ed461c3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f49321c85785178214fd67f2e9b4b73d6363783b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.