https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 11:28:55 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90256 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind</p> <p>hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via hci_conn_timeout (disc_work) -&gt; hci_proto_disconn_ind -&gt; l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted concurrently.</p> <p>disc_work is disabled sync in hci_conn_del(), so we cannot take hci_dev_lock in disc_work.</p> <p>Fix by using proto_lock to guard l2cap_data, in addition to hdev-&gt;lock which is held in other access paths.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind</p> <p>hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via hci_conn_timeout (disc_work) -&gt; hci_proto_disconn_ind -&gt; l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted concurrently.</p> <p>disc_work is disabled sync in hci_conn_del(), so we cannot take hci_dev_lock in disc_work.</p> <p>Fix by using proto_lock to guard l2cap_data, in addition to hdev-&gt;lock which is held in other access paths.</p> https://vulnerability.circl.lu/vuln/cve-2026-90256