{"id":"CVE-2026-99239","kind":"vulnerability","aliases":["CVE-2026-99239"],"related":[],"title":"Linux kernel: Bluetooth L2CAP race can link a channel twice","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn\n\nl2cap_chan may be linked to l2cap_conn at most once. This is assumed in\nseveral places, eg l2cap_chan_del cleanup.\n\nThere is a TOCTOU race where the invariant is violated:\n\n    [Task 1]                          [Task 2]\n    l2cap_chan_connect                l2cap_sock_bind\n      l2cap_chan_lock                   lock_sock\n      l2cap_state_change                if (sk->sk_state != BT_OPEN)\n        chan->state = BT_CONNECT\n        l2cap_sock_state_change_cb      chan->state = BT_BOUND\n                                        sk->sk_state = BT_BOUND\n          lock_sock <------------------ release_sock\n          sk->sk_state = BT_CONNECT\n\nl2cap_sock_connect() does not check sk->sk_state, so since chan->state\nis now BT_BOUND, subsequent connect() ends up with second\n__l2cap_chan_add.\n\nExplicitly document and check the invariant in __l2cap_chan_add with\nWARN_ON_ONCE. The only callsite where it could be hit is\nl2cap_chan_connect, so add pre-check there to avoid relying on\nchan->state. chan->state read/write is not properly guarded currently so\nthere can be other TOCTOUC problems.\n\nAdd l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write.","summary":"A race between Bluetooth socket bind and connect in the Linux kernel can attach one L2CAP channel to a connection twice. The sources do not describe what an attacker can then do beyond crashing or corrupting kernel state.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","linux-kernel","linux-servers","package"],"not_affected_if":["bluetooth-disabled","module-not-loaded","no-local-users"],"how_to_check":"- Run `uname -r` and compare with your distro's kernel changelog or advisory for commit 86b55991d3cd (\"Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn\").\n- Check whether Bluetooth is loaded: `lsmod | grep -E 'bluetooth|l2cap'` (L2CAP is part of the bluetooth module). If not loaded and no Bluetooth hardware, you are very unlikely to be exposed.\n- Check for the kernel config: `grep CONFIG_BT= /boot/config-$(uname -r)`.","fix":"Install a kernel that contains upstream commit 86b55991d3cd690e73c5ef8d20b75ae4905b357a. A backport to the 6.1 and 5.10 stable lines was posted on 2026-10-27, but I found no released stable version number yet. Until then, blacklist the bluetooth module if you don't need it.","status":"open","published_at":"2026-11-02T16:17:49+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","triaged_at":"2026-11-02T16:26:27+00:00","updated_at":"2026-11-02T16:27:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T16:26:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linux kernel: Bluetooth L2CAP race can link a channel twice","impact":"high","summary":"A race between Bluetooth socket bind and connect in the Linux kernel can attach one L2CAP channel to a connection twice. The sources do not describe what an attacker can then do beyond crashing or corrupting kernel state.","audience":"businesses","category":"package","nicknames":[],"who_cares":["linux-kernel","bluetooth","linux-servers"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; kernel memory corruption or crash is possible","analyst_note":"Confirm affected kernel version ranges and whether a fixed stable release is published; the NVD entry lacks version and fix details.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the Bluetooth stack is loaded with `lsmod | grep bluetooth`\n- unknown for the affected kernel version ranges","plain_action":"","needs_analyst":true,"not_affected_if":["bluetooth-disabled","module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the Bluetooth stack loaded are in scope, since the flaw is in the L2CAP code path. Machines without Bluetooth enabled or with the module blocked are unlikely to be exposed. The sources do not state the exact affected kernel versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4559,"output_tokens":542,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected kernel version ranges and whether a fixed stable release is published; the NVD entry lacks version and fix details.","search":"'-2026':12A,15A '-99239':13A,16A '1':117C '2':119C 'add':78C,192C,202C,220C,246C 'alreadi':81C 'assum':97C 'attach':38B 'attack':53B 'avoid':226C 'beyond':57B 'bind':30B,125C,253C 'bluetooth':3A,17B,28B,73C 'bound':152C,157C,183C 'bt':138C,142C,151C,156C,165C,182C 'callsit':209C 'cb':148C 'chan':77C,80C,85C,103C,121C,127C,140C,149C,178C,191C,201C,217C,229C,231C,249C,256C 'chang':133C,147C 'channel':9A,41B 'check':172C,196C,223C 'cleanup':105C 'conn':83C,91C 'connect':32B,44B,122C,143C,166C,169C,185C,218C 'corrupt':60B 'could':212C 'crash':58B 'current':238C 'cve':11A,14A 'del':104C 'describ':50B 'document':194C 'eg':101C 'end':186C 'explicit':193C 'follow':68C 'guard':237C,255C 'hit':214C 'invari':113C,198C 'kernel':2A,20B,36B,61B,66C 'l2cap':4A,40B,74C,76C,84C,90C,102C,120C,123C,126C,131C,144C,167C,190C,200C,216C,247C,251C 'link':7A,88C 'linux':1A,19B,22B,35B,65C 'linux-kernel':18B 'linux-serv':21B 'lock':128C,129C,158C,248C 'may':86C 'one':39B 'open':139C 'packag':24B 'place':100C 'pre':222C 'pre-check':221C 'problem':245C 'proper':236C 'race':5A,26B,110C 'read/write':233C 'refus':75C 'releas':160C 'reli':227C 'resolv':72C 'second':189C 'server':23B 'sever':99C 'sinc':177C 'sk':135C,136C,153C,154C,162C,163C,173C,174C 'sock':124C,130C,145C,159C,161C,168C,252C 'socket':29B 'sourc':47B 'state':62B,132C,137C,141C,146C,150C,155C,164C,175C,179C,230C,232C,257C 'subsequ':184C 'task':116C,118C 'toctou':109C 'toctouc':244C 'twice':10A,45B 'violat':115C 'vulner':69C 'warn':204C 'write':258C","nicknames":[],"mitigations":[],"who_affected":"Linux machines running a kernel with the Bluetooth stack (L2CAP sockets) enabled and where a local user can open Bluetooth sockets. The race is between bind() and connect() on an L2CAP socket, so it needs local code execution. The CVSS vector is local, low-privilege. Servers and containers without Bluetooth, or with the module blocked, can skip it. The affected kernel range is not stated in the sources; it comes from commit b66774b48dd9, whose release version I did not check.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bluetooth","high","linuxkernel","linuxservers","package"],"first_public_at":"2026-11-02T16:17:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99239","severity":null,"published_at":"2026-11-02T16:17:49+00:00","modified_at":"2026-11-02T16:17:49+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","fetched_at":"2026-11-02T16:24:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-99239:1387","url":null,"severity":null,"published_at":"2026-11-02T16:27:26+00:00","modified_at":"2026-11-02T16:27:26+00:00","first_seen_at":"2026-11-02T16:27:26+00:00","fetched_at":"2026-11-02T16:27:26+00:00","note":"Read the upstream patch (Pauli Virtanen, 2026-09-02) and the stable backport posting for 6.1/5.10 (Lee Jones, 2026-10-27). Fix is mainline commit 86b55991d3cd690e73c5ef8d20b75ae4905b357a. Bug introduced by b66774b48dd9. No released stable version numbers or affected range found; both documents are patch postings, not release notes, so nothing is marked verified. No exploitation or PoC seen. Attack vector is local (CVSS AV:L). To settle: the stable release notes (kernel.org) or distro advisories listing the first release containing 86b55991d3cd."}],"documents":[{"id":52845,"url":"https://lists.openwall.net/linux-kernel/2026/09/01/3149","title":"[PATCH 4/4] Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn (Pauli Virtanen, 2026-09-02)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":52846,"url":"https://lists.openwall.net/linux-kernel/2026/10/27/967","title":"[STABLE v6.1-v5.10 2/2] Bluetooth: L2CAP: refuse __l2cap_chan_add (Lee Jones, 2026-10-27)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}