CVE-2026-99239

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) subsystem. A race condition between concurrent socket bind and connect operations allows a communication channel to be attached to a connection multiple times. A local attacker can exploit this flaw to achieve privilege escalation, memory corruption, or a denial of service (DoS) by issuing carefully timed requests across Bluetooth sockets.

This vulnerability is rated as Important severity because an unprivileged local user can exploit the concurrent socket handling flaw to corrupt kernel memory and potentially elevate privileges on systems with Bluetooth enabled. Although exploitation requires local system access, standard unprivileged user accounts can create the required Bluetooth sockets without elevated permissions, enabling complete host compromise. Enterprise installations lacking physical Bluetooth hardware or with the Bluetooth kernel module disabled or omitted are not exposed to this risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to synchronize Bluetooth L2CAP socket bind and connect state updates with channel locking to prevent duplicate channel attachments: upgrade to the corresponding fixed Red Hat builds, which acquire l2cap_chan_lock in l2cap_sock_bind to guard chan->state updates, reject connection attempts in l2cap_chan_connect if chan->conn or FLAG_DEL is set, and refuse __l2cap_chan_add when chan already has an associated conn, closing all 2 injection vectors (concurrent l2cap_sock_bind and l2cap_chan_connect system calls, interleaved socket state modification via multi-threaded Bluetooth socket operations). Until patched, this is only a concern on Linux systems with the Bluetooth subsystem enabled and local unprivileged user access — Systems lacking physical Bluetooth hardware or with the Bluetooth kernel module disabled or omitted are unaffected — so disable or unload the Bluetooth kernel module on hosts where Bluetooth is not required, and restrict unprivileged local users from creating Bluetooth sockets. As a compensating measure, enforce SELinux to restrict confined process domains from creating or interacting with Bluetooth L2CAP sockets, map local users to confined SELinux roles to deny permissions to instantiate raw Bluetooth socket families, deploy EDR agents to detect anomalous privilege escalation behaviors and post-exploit payload execution, use Falco or eBPF runtime security to monitor kernel system call patterns and flag unexpected privilege transitions, enable KASAN or HWASan instrumentation to detect kernel memory corruption and invalid channel pointer reuse, and enable KASLR to randomize kernel code addresses and hinder control-flow redirection during memory corruption. These controls limit blast radius and contain exploitation, but they do not fix the underlying TOCTOU race condition defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)