# Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

CVE record · `CVE-2026-90091`

- **Identifiers:** `CVE-2026-90091`
- **State:** Confirmed
- **Severity:** CVSS 8.0 High
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 17 Sept 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 17 Sept 2026, 16:06 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `b39298044e5534612511a2ff5de03ba5f6e7a820 to before 827de6bd2865b22aaabd554540def3b8a33018ab` (git)
  - affected: `8c37e4338c801ebb8cee52436c01c41e009f6e87 to before 7c7ac736b50fa259ed1bdddc18d79523f07c0442` (git)
  - affected: `84e718b6a814edc84159361f9f454a4e92ae91ae to before 4f8c63fe0097c9f6ea34409f82f79b3894903d91` (git)
  - affected: `36da806f7fbaee56ad9e81859deec203f9728700 to before 61d5ddbd524c715b224cbe7e9f01da4e05098b19` (git)
  - affected: `6fef032af0092ed5ccb767239a9ac1bc38c08a40 to before 32a7bc6e93be36b37fe61f351d312d358195bd61` (git)
  - affected: `6fef032af0092ed5ccb767239a9ac1bc38c08a40 to before 66d6ef18548ae6d7dd452b84115fc82c0a73a4ea` (git)
  - affected: `733e76e74e406c1d1ddc7369420dd8a47f48bb8a` (git)
  - affected: `6.1.178 to before 6.1.188` (semver)
  - affected: `6.6.145 to before 6.6.157` (semver)
  - affected: `6.12.97 to before 6.12.110` (semver)
  - affected: `6.18.40 to before 6.18.52` (semver)
  - affected: `7.1.5 to before 7.2` (semver)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `7.2`
  - unaffected: `before 7.2` (semver)
  - unaffected: `6.1.188 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.157 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.110 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.52 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.6 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 8.0 High, CVSS 3.1: `CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0036, the 30th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 17 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-90091](https://www.cve.org/CVERecord?id=CVE-2026-90091)
- [NVD: CVE-2026-90091](https://nvd.nist.gov/vuln/detail/CVE-2026-90091)

### References from the CNA

- <https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab>
- <https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442>
- <https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91>
- <https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19>
- <https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61>
- <https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-90091>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-90091/>. Everything for agents: <https://agentprime.io/llms.txt>.