01 Record

CVE-2026-90092

Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

HighPUBLISHEDCNA: Linux

CNA base score8.0 CVSS v3.xCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.36% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 29.7% of scored records. A rank, not a probability.
NVD base score: 8.0 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Received. NVD last modified this record on 2026-10-19.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-09-17 16:06Z1 MO AGO

Last updated

2026-10-19 08:57Z10 DAYS AGO

Reserved

2026-09-11

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.0)

CNA CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-825Expired Pointer DereferenceBase
CWE-416Use After FreeVariant

Data version

5.2

Document digest

f61ebe760b8c5df4d509f697f17188e7d2eaccd0ced52706d28bb7eb407e1705

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux0c17c8832562b2aac288e89cefd0f46074f54bcb to < bf61a65c6093970e3b50031c4b79ebf3bd411eba, 5105f3e6b2df619c635b5f6a49fac131a36c7952 to < 491e4c60017969b053888029998d2a61f298986a, c88c185ae0a1067823661b220aeea613df2c127b to < 2a3a27aaf19bf069720e024ce6fde54e6bf80df9, 1810e42ff6716f320c7269d5850eca48b07b7427 to < 87276dc15b559d32757a43b4415c8445fbae06c4, 2ff1a41a912de8517b4482e946dd951b7d80edbf to < c47339e169bf4a0a4cfabb91351471f67744c2bc, 2ff1a41a912de8517b4482e946dd951b7d80edbf to < d4bfa78fd67929b62b02013c107973e0c5b7aa9a, 1b1c0da227bf63479bac9982fc8d12df9aaea0fb, 85426e97dc72f2088ba6d27e74cd58c3fbd43e31, a2dcf1a61d056aef15b63c6eae9441344d624389, 6.1.175 to < 6.1.188, 6.6.140 to < 6.6.157, 6.12.88 to < 6.12.110, 6.18.30 to < 6.18.52, 5.10.258 to < 5.11, 5.15.209 to < 5.16, 7.0.7 to < 7.1, 7.1—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/bf61a65c6093970e3b50031c4b79ebf3bd411eba
git.kernel.orghttps://git.kernel.org/stable/c/491e4c60017969b053888029998d2a61f298986a
git.kernel.orghttps://git.kernel.org/stable/c/2a3a27aaf19bf069720e024ce6fde54e6bf80df9
git.kernel.orghttps://git.kernel.org/stable/c/87276dc15b559d32757a43b4415c8445fbae06c4
git.kernel.orghttps://git.kernel.org/stable/c/c47339e169bf4a0a4cfabb91351471f67744c2bc
git.kernel.orghttps://git.kernel.org/stable/c/d4bfa78fd67929b62b02013c107973e0c5b7aa9a

07 Fixed in

Debian 12

linux
Fixed in 6.1.190-1
linux-6.12
Fixed in 6.12.111-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.111-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.2.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.