CVE-2026-99239

Status: UPDATED  |  Advisory ID: CVE-2026-99239

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

l2cap_chan may be linked to l2cap_conn at most once. This is assumed in

several places, eg l2cap_chan_del cleanup.

There is a TOCTOU race where the invariant is violated:

[Task 1] [Task 2]

l2cap_chan_connect l2cap_sock_bind

l2cap_chan_lock lock_sock

l2cap_state_change if (sk->sk_state != BT_OPEN)

chan->state = BT_CONNECT

l2cap_sock_state_change_cb chan->state = BT_BOUND

sk->sk_state = BT_BOUND

lock_sock <------------------ release_sock

sk->sk_state = BT_CONNECT

l2cap_sock_connect() does not check sk->sk_state, so since chan->state

is now BT_BOUND, subsequent connect() ends up with second

__l2cap_chan_add.

Explicitly document and check the invariant in __l2cap_chan_add with

WARN_ON_ONCE. The only callsite where it could be hit is

l2cap_chan_connect, so add pre-check there to avoid relying on

chan->state. chan->state read/write is not properly guarded currently so

there can be other TOCTOUC problems.

Add l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References