CVE record · CVE-2026-90091

Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

CVSS 8.0 HighEPSS 0.0036 · 30th percentile

Published by the CVE Program (CNA: Linux) at 17 Sept 2026, 16:06 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected b39298044e5534612511a2ff5de03ba5f6e7a820 to before 827de6bd2865b22aaabd554540def3b8a33018ab git affected 8c37e4338c801ebb8cee52436c01c41e009f6e87 to before 7c7ac736b50fa259ed1bdddc18d79523f07c0442 git affected 84e718b6a814edc84159361f9f454a4e92ae91ae to before 4f8c63fe0097c9f6ea34409f82f79b3894903d91 git affected 36da806f7fbaee56ad9e81859deec203f9728700 to before 61d5ddbd524c715b224cbe7e9f01da4e05098b19 git affected 6fef032af0092ed5ccb767239a9ac1bc38c08a40 to before 32a7bc6e93be36b37fe61f351d312d358195bd61 git affected 6fef032af0092ed5ccb767239a9ac1bc38c08a40 to before 66d6ef18548ae6d7dd452b84115fc82c0a73a4ea git affected 733e76e74e406c1d1ddc7369420dd8a47f48bb8a git affected 6.1.178 to before 6.1.188 semver affected 6.6.145 to before 6.6.157 semver affected 6.12.97 to before 6.12.110 semver affected 6.18.40 to before 6.18.52 semver affected 7.1.5 to before 7.2 semver Other versions: unaffected
Linux	Linux	affected 7.2 unaffected before 7.2 semver unaffected 6.1.188 to 6.1., inclusive semver unaffected 6.6.157 to 6.6., inclusive semver unaffected 6.12.110 to 6.12., inclusive semver unaffected 6.18.52 to 6.18., inclusive semver unaffected 7.2.6 to 7.2., inclusive semver unaffected 7.3 to , inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-90091
CNA: Linux
Tags: Linux kernel
Published: 17 Sept 2026
Updated: 19 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
8.0	High	3.1	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CNA (Linux)

CISA KEV Not listed.
EPSS 0.0036, the 30th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 17 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.