Linux Kernel L2CAP TOCTOU Race in __l2cap_chan_add
CVE-2026-99239 Published on November 2, 2026
Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
l2cap_chan may be linked to l2cap_conn at most once. This is assumed in
several places, eg l2cap_chan_del cleanup.
There is a TOCTOU race where the invariant is violated:
[Task 1] [Task 2]
l2cap_chan_connect l2cap_sock_bind
l2cap_chan_lock lock_sock
l2cap_state_change if (sk->sk_state != BT_OPEN)
chan->state = BT_CONNECT
l2cap_sock_state_change_cb chan->state = BT_BOUND
sk->sk_state = BT_BOUND
lock_sock <------------------ release_sock
sk->sk_state = BT_CONNECT
l2cap_sock_connect() does not check sk->sk_state, so since chan->state
is now BT_BOUND, subsequent connect() ends up with second
__l2cap_chan_add.
Explicitly document and check the invariant in __l2cap_chan_add with
WARN_ON_ONCE. The only callsite where it could be hit is
l2cap_chan_connect, so add pre-check there to avoid relying on
chan->state. chan->state read/write is not properly guarded currently so
there can be other TOCTOUC problems.
Add l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write.
Products Associated with CVE-2026-99239
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 8f90405a4a6f1f1880dc07996b47bf57c712bd8a and below 85cc289eb08afa975375f838187369e68b429ee0 is affected.
- Version 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b and below 820579652b24ce277e0097cd65b42bd9b7b8bf07 is affected.
- Version 8922c7940bae9ce4b1736dddb6362370793835c2 and below e618d928ec7f88cbeadfa3542adcac40f474e629 is affected.
- Version 91047a4396a8b1857a6f712a90cf33ec0012b189 and below fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2 is affected.
- Version 0b0e2bf39cf99e458d991b9df253727e036a7d7d and below 52fe88e4ef87311eee32b45c65603e7c69e75e7d is affected.
- Version d3b739db5dc6f688a60d56da872fabaf65246032 and below 10c705dd706aa93164ba41f2566f15206d6c178e is affected.
- Version b66774b48dd98f07254951f74ea6f513efe7ff8b and below 73820561d8cbfd3364a29b8fa77f1707f26029da is affected.
- Version b66774b48dd98f07254951f74ea6f513efe7ff8b and below d3afd7803f9bc2a8c4270199497b60158b2fc647 is affected.
- Version 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277 is affected.
- Version 5.10.265 and below 5.10.273 is affected.
- Version 5.15.216 and below 5.15.224 is affected.
- Version 6.1.183 and below 6.1.191 is affected.
- Version 6.6.145 and below 6.6.161 is affected.
- Version 6.12.97 and below 6.12.115 is affected.
- Version 6.18.39 and below 6.18.60 is affected.
- Version 7.1.4 and below 7.2 is affected.
- Version 7.2 is affected.
- Before 7.2 is unaffected.
- Version 5.10.273, <= 5.10.* is unaffected.
- Version 5.15.224, <= 5.15.* is unaffected.
- Version 6.1.191, <= 6.1.* is unaffected.
- Version 6.6.161, <= 6.6.* is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.
- Version 7.3.1, <= 7.3.* is unaffected.