Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-11-02T16:06:43 kernel: kernel: Privilege escalation via race condition in Bluetooth L2CAP 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-416

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn l2cap_chan may be linked to l2cap_conn at most once. This is assumed in several places, eg l2cap_chan_del cleanup. There is a TOCTOU race where the invariant is violated: [Task 1] [Task 2] l2cap_chan_connect l2cap_sock_bind l2cap_chan_lock lock_sock l2cap_state_change if (sk->sk_state != BT_OPEN) chan->state = BT_CONNECT l2cap_sock_state_change_cb chan->state = BT_BOUND sk->sk_state = BT_BOUND lock_sock <------------------ release_sock sk->sk_state = BT_CONNECT l2cap_sock_connect() does not check sk->sk_state, so since chan->state is now BT_BOUND, subsequent connect() ends up with second __l2cap_chan_add. Explicitly document and check the invariant in __l2cap_chan_add with WARN_ON_ONCE. The only callsite where it could be hit is l2cap_chan_connect, so add pre-check there to avoid relying on chan->state. chan->state read/write is not properly guarded currently so there can be other TOCTOUC problems. Add l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write.

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) subsystem. A race condition between concurrent socket bind and connect operations allows a communication channel to be attached to a connection multiple times. A local attacker can exploit this flaw to achieve privilege escalation, memory corruption, or a denial of service (DoS) by issuing carefully timed requests across Bluetooth sockets.

A TOCTOU race between l2cap_chan_connect and l2cap_sock_bind can change chan state and allow a second __l2cap_chan_add for the same L2CAP channel. Readding the same intrusive channel object violates connection lifetime and list invariants and can leave l2cap_chan_del or later list traversal operating on corrupted linkage or stale references. This creates a plausible UAF or invalid list dereference path with kernel crash as the clearest impact and possible confidentiality or integrity impact from memory corruption. For the CVSS the PR:L value is selected because a local unprivileged process must operate a Bluetooth L2CAP socket and race bind against connect. AC:H reflects the required timing window. The issue is not directly remotely reachable although a usable Bluetooth stack and connection path are prerequisites. --- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to synchronize Bluetooth L2CAP socket bind and connect state updates with channel locking to prevent duplicate channel attachments: upgrade to the corresponding fixed Red Hat builds, which acquire l2cap_chan_lock in l2cap_sock_bind to guard chan->state updates, reject connection attempts in l2cap_chan_connect if chan->conn or FLAG_DEL is set, and refuse __l2cap_chan_add when chan already has an associated conn, closing all 2 injection vectors (concurrent l2cap_sock_bind and l2cap_chan_connect system calls, interleaved socket state modification via multi-threaded Bluetooth socket operations). Until patched, this is only a concern on Linux systems with the Bluetooth subsystem enabled and local unprivileged user access — Systems lacking physical Bluetooth hardware or with the Bluetooth kernel module disabled or omitted are unaffected — so disable or unload the Bluetooth kernel module on hosts where Bluetooth is not required, and restrict unprivileged local users from creating Bluetooth sockets. As a compensating measure, enforce SELinux to restrict confined process domains from creating or interacting with Bluetooth L2CAP sockets, map local users to confined SELinux roles to deny permissions to instantiate raw Bluetooth socket families, deploy EDR agents to detect anomalous privilege escalation behaviors and post-exploit payload execution, use Falco or eBPF runtime security to monitor kernel system call patterns and flag unexpected privilege transitions, enable KASAN or HWASan instrumentation to detect kernel memory corruption and invalid channel pointer reuse, and enable KASLR to randomize kernel code addresses and hinder control-flow redirection during memory corruption. These controls limit blast radius and contain exploitation, but they do not fix the underlying TOCTOU race condition defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium) Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-10 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-99239 https://nvd.nist.gov/vuln/detail/CVE-2026-99239 https://git.kernel.org/stable/c/10c705dd706aa93164ba41f2566f15206d6c178e https://git.kernel.org/stable/c/52fe88e4ef87311eee32b45c65603e7c69e75e7d https://git.kernel.org/stable/c/73820561d8cbfd3364a29b8fa77f1707f26029da https://git.kernel.org/stable/c/820579652b24ce277e0097cd65b42bd9b7b8bf07 https://git.kernel.org/stable/c/85cc289eb08afa975375f838187369e68b429ee0 https://git.kernel.org/stable/c/d3afd7803f9bc2a8c4270199497b60158b2fc647 https://git.kernel.org/stable/c/e618d928ec7f88cbeadfa3542adcac40f474e629 https://git.kernel.org/stable/c/fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2 https://kernelcve.org/list/?q=CVE-2026-99239