Live › vulnerability › CVE-2026-99239
A race between Bluetooth socket bind and connect in the Linux kernel can attach one L2CAP channel to a connection twice. The sources do not describe what an attacker can then do beyond crashing or corrupting kernel state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Linux machines running a kernel with the Bluetooth stack (L2CAP sockets) enabled and where a local user can open Bluetooth sockets. The race is between bind() and connect() on an L2CAP socket, so it needs local code execution. The CVSS vector is local, low-privilege. Servers and containers without Bluetooth, or with the module blocked, can skip it. The affected kernel range is not stated in the sources; it comes from commit b66774b48dd9, whose release version I did not check.
No product ranges from the sources yet.
uname -r and compare with your distro's kernel changelog or advisory for commit 86b55991d3cd ("Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn").lsmod | grep -E 'bluetooth|l2cap' (L2CAP is part of the bluetooth module). If not loaded and no Bluetooth hardware, you are very unlikely to be exposed.grep CONFIG_BT= /boot/config-$(uname -r).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
l2cap_chan may be linked to l2cap_conn at most once. This is assumed in several places, eg l2cap_chan_del cleanup.
There is a TOCTOU race where the invariant is violated:
[Task 1] [Task 2]
l2cap_chan_connect l2cap_sock_bind
l2cap_chan_lock lock_sock
l2cap_state_change if (sk->sk_state != BT_OPEN)
chan->state = BT_CONNECT
l2cap_sock_state_change_cb chan->state = BT_BOUND
sk->sk_state = BT_BOUND
lock_sock <------------------ release_sock
sk->sk_state = BT_CONNECT
l2cap_sock_connect() does not check sk->sk_state, so since chan->state is now BT_BOUND, subsequent connect() ends up with second __l2cap_chan_add.
Explicitly document and check the invariant in __l2cap_chan_add with WARN_ON_ONCE. The only callsite where it could be hit is l2cap_chan_connect, so add pre-check there to avoid relying on chan->state. chan->state read/write is not properly guarded currently so there can be other TOCTOUC problems.
Add l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write.
This page as .md · .json · in your agent: get_signal("CVE-2026-99239")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.