high · CVSS 7.8

CVE-2026-99239

Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

Published 2 Nov 2026 · Source updated 3 Nov 2026 · Retrieved 2026-11-04 20:14 UTC

Monitor this CVE ↗Full CVE monitoring on Pro and Business

What happened?

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

l2cap_chan may be linked to l2cap_conn at most once. This is assumed in several places, eg l2cap_chan_del cleanup.

There is a TOCTOU race where the invariant is violated:

[Task 1] [Task 2] l2cap_chan_connect l2cap_sock_bind l2cap_chan_lock lock_sock l2cap_state_change if (sk->sk_state != BT_OPEN) chan->state = BT_CONNECT l2cap_sock_state_change_cb chan->state = BT_BOUND sk->sk_state = BT_BOUND lock_sock <------------------ release_sock sk->sk_state = BT_CONNECT

l2cap_sock_connect() does not check sk->sk_state, so since chan->state is now BT_BOUND, subsequent connect() ends up with second __l2cap_chan_add.

Explicitly document and check the invariant in __l2cap_chan_add with WARN_ON_ONCE. The only callsite where it could be hit is l2cap_chan_connect, so add pre-check there to avoid relying on chan->state. chan->state read/write is not properly guarded currently so there can be other TOCTOUC problems.

Add l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write.

Description supplied by CVE Program. Formatting is simplified; follow the original advisory for full details.

Affected software and versions

Source-provided software and version information
Software	Version information	Fixed version
LinuxLinux	affected: 8f90405a4a6f1f1880dc07996b47bf57c712bd8a to < 85cc289eb08afa975375f838187369e68b429ee0; affected: 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b to < 820579652b24ce277e0097cd65b42bd9b7b8bf07; affected: 8922c7940bae9ce4b1736dddb6362370793835c2 to < e618d928ec7f88cbeadfa3542adcac40f474e629; affected: 91047a4396a8b1857a6f712a90cf33ec0012b189 to < fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2; affected: 0b0e2bf39cf99e458d991b9df253727e036a7d7d to < 52fe88e4ef87311eee32b45c65603e7c69e75e7d; affected: d3b739db5dc6f688a60d56da872fabaf65246032 to < 10c705dd706aa93164ba41f2566f15206d6c178e; affected: b66774b48dd98f07254951f74ea6f513efe7ff8b to < 73820561d8cbfd3364a29b8fa77f1707f26029da; affected: b66774b48dd98f07254951f74ea6f513efe7ff8b to < d3afd7803f9bc2a8c4270199497b60158b2fc647; affected: b66774b48dd98f07254951f74ea6f513efe7ff8b to < 86b55991d3cd690e73c5ef8d20b75ae4905b357a; affected: 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277; affected: 5.10.265 to < 5.10.273; affected: 5.15.216 to < 5.15.224; affected: 6.1.183 to < 6.1.191; affected: 6.6.145 to < 6.6.161; affected: 6.12.97 to < 6.12.115; affected: 6.18.39 to < 6.18.60; affected: 7.1.4 to < 7.2	See vendor advisory
LinuxLinux	affected: 7.2; unaffected: 0 to < 7.2; unaffected: 5.10.273 to ≤ 5.10.; unaffected: 5.15.224 to ≤ 5.15.; unaffected: 6.1.191 to ≤ 6.1.; unaffected: 6.6.161 to ≤ 6.6.; unaffected: 6.12.115 to ≤ 6.12.; unaffected: 6.18.60 to ≤ 6.18.; unaffected: 7.2.14 to ≤ 7.2.; unaffected: 7.3.1 to ≤ 7.3.; unaffected: 7.4-rc1 to ≤ *	See vendor advisory

Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.

Is it being exploited?

This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.

CISA data retrieved 2026-11-06 16:38 UTC. Check CISA ↗

How to respond

Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.

Sources and remediation references

This public advisory does not determine whether a particular server is affected. Records are refreshed as sources change; verify urgent decisions against the original advisory.

← Browse the public CVE feed