UBUNTU-CVE-2026-99239: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated: [Task 1] [Task 2] l2capchanconnect l2capsockbind l2capchanlock locksock l2capstatechange if (sk->skstate != BTOPEN) chan->state = BTCONNECT l2capsockstatechangecb chan->state = BTBOUND sk->skstate = BTBOUND locksock <------------------ releasesock sk->skstate = BTCONNECT l2capsockconnect() does not check sk->skstate, so since chan->state is now BTBOUND, subsequent connect() ends up with second l2capchanadd. Explicitly document and check the invariant in l2capchanadd with WARNONONCE. The only callsite where it could be hit is l2capchanconnect, so add pre-check there to avoid relying on chan->state. chan->state read/write is not properly guarded currently so there can be other TOCTOUC problems. Add l2caplockchan in l2capsockbind() to guard chan->state write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add l2cap_lock_chan in l2cap_sock_bind() to guard the chan->state write.
- Compensating control
In __l2cap_chan_add, explicitly document the invariant that an l2cap_chan may be linked to an l2cap_conn at most once and enforce it with WARN_ON_ONCE.
- Compensating control
Add a pre-check in l2cap_chan_connect to refuse the operation when the channel already has a connection, rather than relying on chan->state.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vector requires local access and low privileges. No user interaction is required.
Which Ubuntu kernel packages are listed as affected?
The listed software includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-aws-fips, and ubuntu/linux-azure-fips.
Is this exposed remotely by the published severity vector?
The supplied vector identifies the attack vector as local (AV:L). It does not describe a remote exploitation path.