CVE-2026-99239

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.273 Linux kernel versions prior to 5.15.224

Description A race condition exists in the Bluetooth L2CAP channel setup. A local user can trigger a Time-of-Check to Time-of-Use (TOCTOU) race by racing socket bind and connect calls, which violates an invariant where an l2cap chan should be linked to an l2cap conn at most once. This occurs because l2cap sock connect() does not check the sk->sk state variable, and the chan->state variable is not properly guarded, potentially leading to a second call to the l2cap chan add() function.

Recommendations Update to version 5.10.273. Update to version 5.15.224.