What is the CVSS score of CVE-2026-90093?

CVE-2026-90093 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-90093?

Within 24 hours, identify all Linux systems with Bluetooth enabled (CONFIG_BT) and determine if they run affected kernel versions; if Bluetooth is not required, disable it via rfkill or module blacklisting as a temporary workaround. Within 7 days, obtain the vendor-released kernel patches from your Linux distribution (e.g., Red Hat, Ubuntu, SUSE) by referencing the vendor advisory for CVE-2026-90093, and test them in a staging environment before deployment. Within 30 days, apply the patches broadly across production systems, verify that the updated kernel version matches the vendor advisory, and enforce change management while monitoring for any recurring crashes.

Linux Kernel CVE-2026-90093

EUVD-2026-81954 HIGH

2026-09-17 Linux

GHSA-vcch-q6jx-pg5j

Denial Of Service Linux Bluetooth

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Local user opens L2CAP socket
Delivery

Trigger hci_conn deletion leaving stale conn ref
Exploit

Race get/setsockopt to deref freed hcon->hdev
Execution

Invalid kernel read
Impact

Kernel oops / DoS

Vulnerability Assessment

Exploitation Conditions	Requires a local user on a Linux host with the kernel Bluetooth stack enabled (CONFIG_BT) and an L2CAP socket, per AV:L/PR:L. The attacker must drive an hci_conn to deletion while the l2cap_chan still holds its conn reference (the state introduced by commit b66774b48dd9), then invoke getsockopt/setsockopt to dereference the stale conn->hcon->hdev - a race window that the fix closes with l2cap_chan_lock() and an alive-hcon check. Limiting factors: no remote reach (local only), requires Bluetooth to be present/usable, and requires winning a teardown race, so exploitation is neither remote nor deterministic. Impact is a kernel crash (DoS), not confirmed information disclosure or privilege escalation.
Impact	This is a Linux kernel Bluetooth L2CAP use-after-free / data-race in l2cap_sock get/setsockopt: since commit b66774b48dd9, l2cap_chan::conn holds a reference and stays non-NULL after the underlying hci_conn is deleted, so dereferencing conn->hcon->hdev in setsockopt reads freed/invalid memory and triggers a KASAN crash. The vendor CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this as a fully-impacting local memory-corruption bug, but the described outcome is a KASAN-detected invalid read producing a kernel oops - i.e. availability loss, not demonstrated confidentiality/integrity compromise; C:H and I:H are therefore overstated. The flaw is a race/lifetime window (the fix adds l2cap_chan_lock() and an alive-hcon check specifically to close a race), so AC:L is optimistic - reliably hitting the freed state realistically requires winning a race against hci_conn teardown, arguing for AC:H. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or imminent exploitation. Net: a legitimate local DoS hardening fix, not a high-priority remotely-exploitable issue; the AV:L requirement (local user holding an L2CAP socket) and the race condition sharply limit real-world risk relative to the 7.8 headline.
Exploit ScenarioDerived	A local unprivileged user opens an L2CAP socket, establishes and then tears down a Bluetooth connection so the hci_conn is deleted while the channel's conn reference persists, then calls setsockopt/getsockopt to force a dereference of the now-stale conn->hcon->hdev. Winning this race yields an invalid/use-after-free kernel read and a KASAN-detected oops, crashing the kernel. No public exploit code is identified in the provided data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

Local users on Linux hosts running the kernel Bluetooth stack (CONFIG_BT) can crash the system by racing an hci_conn teardown against L2CAP getsockopt()/setsockopt() calls, producing a KASAN-detected use-after-free in l2cap_sock.c. Since commit b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref"), l2cap_chan::conn keeps a reference and remains non-NULL after the underlying hci_conn is freed, so dereferencing conn->hcon->hdev reads released memory. Impact is a kernel denial of service rather than confirmed information disclosure or privilege escalation, and the assessed vector (AV:L/AC:H/PR:L/UI:N, A:H) reflects that exploitation is local-only and requires winning a teardown race; no public exploit code or CISA KEV entry was identified at time of analysis. Vendor-released patches are available in the stable kernel versions listed below.

RemediationAI

Vendor-released patch: update to Linux 5.10.265, 5.15.216, 6.1.183, 6.6.145, 6.12.97, 6.18.39, or 7.2.6 (or mainline 7.3-rc1) respectively for your branch; the stable fix commits are f49321c85785178214fd67f2e9b4b73d6363783b and ca2c4c26498643f421d35ffe258fafbd3ed461c3 as listed at https://git.kernel.org/stable/c/f49321c85785178214fd67f2e9b4b73d6363783b and https://git.kernel.org/stable/c/ca2c4c26498643f421d35ffe258fafbd3ed461c3, with tracking at https://nvd.nist.gov/vuln/detail/CVE-2026-90093. Because the bug requires a local process holding an L2CAP socket plus the ability to race an hci_conn teardown, the practical compensating control is to remove that attack surface: disable the Bluetooth stack entirely (for example blacklist the bluetooth, btusb and related modules or disable Bluetooth in the kernel config/BIOS) and stop/deny bluetoothd on hosts that do not need wireless PAN/audio/L2CAP sockets - the trade-off is loss of all Bluetooth functionality. On systems where Bluetooth is required, restrict local interactive access and L2CAP socket creation to trusted accounts and keep Bluetooth adapters powered down except during approved use, accepting that this only narrows the race window rather than eliminating the freed-hcon state. Since a KASAN build is needed to observe the crash reliably, production kernels may silently corrupt state, so patching should not be deferred on the assumption that the bug is merely a diagnostic crash.

Affected VersionsENISA

Linux 7.1.4 <7.2

Linux 7.2

Linux 91047a4396a8b1857a6f712a90cf33ec0012b189

Linux 5.15.216 <5.16

Linux 8f90405a4a6f1f1880dc07996b47bf57c712bd8a

Linux 0b0e2bf39cf99e458d991b9df253727e036a7d7d

Linux 6.12.97 <6.13

Linux 6.18.39 <6.19

Linux patch: 7.3-rc1

Linux 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b

Linux 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277

Linux d3b739db5dc6f688a60d56da872fabaf65246032

Linux 6.1.183 <6.2

Linux 6.6.145 <6.7

Linux 5.10.265 <5.11

Linux patch: 7.2.6

Linux b66774b48dd98f07254951f74ea6f513efe7ff8b <f49321c85785178214fd67f2e9b4b73d6363783b

Linux 8922c7940bae9ce4b1736dddb6362370793835c2

Linux b66774b48dd98f07254951f74ea6f513efe7ff8b <ca2c4c26498643f421d35ffe258fafbd3ed461c3

Linux patch: 0

Affected Packages

euvd linux fix: 5.11, 5.16, 6.2, 6.7, 6.13, 6.19, 7.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw sits at the intersection of Bluetooth L2CAP socket handling and the HCI connection lifecycle inside the Linux kernel. L2CAP channels (struct l2cap_chan) are tied to a lower-level HCI connection (struct hci_conn) via l2cap_chan::conn, and code paths in l2cap_sock.c - notably getsockopt() and setsockopt() - walk conn->hcon->hdev. Commit b66774b48dd9 deliberately changed the lifetime model so that l2cap_chan::conn holds a reference and stays non-NULL even after the corresponding hci_conn is deleted; the side effect is that code assuming conn->hcon still points at live HCI device state can dereference a freed or reallocated object, which KASAN reports as a use-after-free and which is also a data race on l2cap_chan fields. The fix checks that l2cap_chan::conn.hcon corresponds to an alive hci_conn before use and holds l2cap_chan_lock() across getsockopt/setsockopt so the channel state cannot be mutated concurrently. In CWE terms this is a use-after-free (CWE-416) combined with a race condition (CWE-362) reachable through the AF_BLUETOOTH/L2CAP socket API; the CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all affected kernel trees.

Know when Bluetooth gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 4.7 MEDIUM

Local L2CAP socket (AV:L/PR:L); reliably hitting the freed state requires winning a teardown race (AC:H); described outcome is a KASAN crash so A:H only, no demonstrated C/I impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 4.7 MEDIUM

AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 18, 2026 - 18:22 NVD

7.8 (HIGH)

Patch available

Sep 17, 2026 - 17:19 EUVD

CVE Published

Sep 17, 2026 - 16:06 cve.org

HIGH 7.8

CVE Published

Sep 17, 2026 - 16:06 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

Since commit b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") l2cap_chan::conn has held reference and remains non-NULL also after the corresponding hci_conn is deleted. In this state accessing various fields eg. hci_conn::hdev is invalid, which leads to KASAN crash in l2cap_sock_setsockopt() access of conn->hcon->hdev.

Check l2cap_chan::conn.hcon corresponds to an alive hci_conn before trying to use it in l2cap_sock.c. Hold l2cap_chan_lock() in getsockopt/setsockopt to ensure it stays alive, and to avoid data races in l2cap_chan fields.

Executive ViewAI

Why It Matters

A high-severity flaw in the Linux kernel Bluetooth stack (CVE-2026-90093) allows a local user to crash affected hosts by racing a connection teardown against socket operations, resulting in a kernel denial-of-service condition. The vulnerability requires local access with low privileges and precise timing, and no public exploit was identified at time of analysis. Leadership should ensure timely patching of Linux servers and workstations with Bluetooth enabled to prevent availability disruptions.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Prevalence

High

Linux kernel is ubiquitous but exploitation requires CONFIG_BT and Bluetooth L2CAP sockets

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Bluetooth

View all

CVE-2025-65824 HIGH This Week POC

8.8 Dec 10

Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware

CVE-2025-32879 HIGH This Week POC

8.8 Jun 20

CVE-2025-32879 is a security vulnerability (CVSS 8.8) that allows an attacker. Risk factors: public PoC available.

CVE-2025-10457 HIGH This Week POC

8.1 Sep 19

Zephyr's Bluetooth Low Energy connection-response handler fails to verify that a connection request was actually initiat

CVE-2025-20672 CRITICAL Act Now

9.8 Jun 02

Heap OOB write in Android Bluetooth driver via incorrect bounds check.

CVE-2026-55330 CRITICAL Act Now

9.8 Oct 06

A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an att

CVE-2020-10135 MEDIUM This Month POC

5.4 May 19

Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may

CVE-2026-19570 HIGH This Week

8.8 Oct 09

Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attac

CVE-2026-90255 HIGH This Week

8.8 Sep 17

A memory leak combined with a use-after-free in the Linux kernel's Bluetooth HCI connection-setup path can crash the ker

CVE-2026-90256 HIGH This Week

8.8 Sep 17

A race condition in the Linux kernel's Bluetooth L2CAP subsystem allows a use-after-free of the hci_conn::l2cap_data poi

CVE-2026-8374 HIGH This Week

8.5 Oct 09

Bluetooth authentication bypass in SwitchBot Door Lock Series allows an attacker within BLE range to manipulate the lock

CVE-2026-89583 HIGH This Week

8.1 Sep 11

Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into usersp

CVE-2026-118603 HIGH This Week

8.0 Oct 28

A stack-based buffer overflow in the vCard parser of the Alpine iLX-F511 in-dash multimedia receiver (build 7.0.0000) le

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back