{"id":"AZL-102993","summary":"CVE-2026-90092 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: reject accept queue add unless BT_LISTEN\n\nNew sk should not be added to parent socket accept queue after last\nl2cap_sock_cleanup_listen() has run in l2cap_sock_teardown_cb() and\nstate set to BT_CLOSED, as that can result to UAF on dereferencing the\ndangling parent reference.\n\nl2cap_sock_new_connection_cb() may race with parent l2cap_chan teardown,\ndue to chan-\u003estate accessed without consistent locking:\n\n  [Task 1]                           [Task 2]\n  l2cap_sock_release(parent)         l2cap_connect\n    l2cap_sock_shutdown                pchan = l2cap_global_chan_by_psm\n      l2cap_chan_lock(pchan)\n      l2cap_chan_close\n        l2cap_sock_teardown_cb\n          pchan-\u003estate = BT_CLOSED\n      l2cap_chan_unlock(pchan) ------\u003e l2cap_chan_lock(pchan)\n                                       l2cap_new_connection\n                                         l2cap_sock_new_connection_cb\n      l2cap_chan_lock(pchan) \u003c-------- l2cap_chan_unlock(pchan)\n      l2cap_sock_kill(parent)          /* bt_sk(sk)-\u003eparent dangling */\n\nFix by adding check for sk_state == BT_LISTEN after acquiring sk lock in\nl2cap_sock_new_connection_cb().  Add lock_sock() around sk_state writes\nwhere missing, to avoid data races.\n\nAlthough the data races on pchan-\u003estate should be fixed too, this\ndefensive sk_state check probably makes sense in any case.","modified":"2026-09-18T14:18:02.860021203Z","published":"2026-09-17T17:17:00Z","upstream":["CVE-2026-90092"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90092"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-102993.json"}}],"schema_version":"1.9.0"}