{"apiVersion":"1.0","identifier":"CVE-2026-99239","description":"In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn l2cap_chan may be linked to l2cap_conn at most once. This is assumed in several places, eg l2cap_chan_del cleanup. There is a TOCTOU race where the invariant is violated: [Task 1] [Task 2] l2cap_chan_connect l2cap_sock_bind l2cap_chan_lock lock_sock l2cap_state_change if (sk->sk_state != BT_OPEN) chan->state = BT_CONNECT l2cap_sock_state_change_cb chan->state = BT_BOUND sk->sk_state = BT_BOUND lock_sock <------------------ release_sock sk->sk_state = BT_CONNECT l2cap_sock_connect() does not check sk->sk_state, so since chan->state is now BT_BOUND, subsequent connect() ends up with second __l2cap_chan_add. Explicitly document and check the invariant in __l2cap_chan_add with WARN_ON_ONCE. The only callsite where it could be hit is l2cap_chan_connect, so add pre-check there to avoid relying on chan->state. chan->state read/write is not properly guarded currently so there can be other TOCTOUC problems. Add l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write.","publishedAt":"2026-11-02T16:17:49","lastModifiedAt":"2026-11-03T20:18:30","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99239","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00126,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99239","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99239","en":"https://www.redsauce.net/en/cves/CVE-2026-99239","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99239","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99239","de":"https://www.redsauce.net/de/cves/CVE-2026-99239","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99239","el":"https://www.redsauce.net/el/cves/CVE-2026-99239"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99239"}}