CVE-2026-99239: 
Linux Debian Analyse et atténuation de la vulnérabilité

CVE-2026-99239 is a Time-of-Check Time-of-Use (TOCTOU) race condition in the Linux kernel's Bluetooth L2CAP implementation that can allow a local attacker to trigger memory corruption or kernel crash, potentially leading to local code execution. The vulnerability arises because an l2cap_chan can be incorrectly linked to an l2cap_conn more than once due to insufficient state checking and locking between l2cap_chan_connect() and l2cap_sock_bind(). It was published on November 2, 2026, and affects multiple stable Linux kernel branches. Affected versions include 5.10.265–5.10.272, 5.15.216–5.15.223, 6.1.183–6.1.190, 6.6.145–6.6.160, 6.12.97–6.12.114, 6.18.39–6.18.59, 7.1.4, and 7.2. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat).

The root cause is a TOCTOU race condition (CWE-367) in the Linux kernel Bluetooth L2CAP subsystem. The invariant that an l2cap_chan may be linked to an l2cap_conn at most once is violated when two tasks concurrently execute l2cap_chan_connect() (Task 1) and l2cap_sock_bind() (Task 2): Task 1 sets chan->state to BT_CONNECT, while Task 2 sets it to BT_BOUND before Task 1 acquires the socket lock, causing l2cap_sock_connect() — which does not check sk->sk_state — to call __l2cap_chan_add() a second time. The fix adds a WARN_ON_ONCE invariant check in __l2cap_chan_add(), a pre-check in l2cap_chan_connect() to avoid relying on chan->state, and introduces l2cap_lock_chan in l2cap_sock_bind() to properly guard chan->state writes (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows a local user with the ability to create Bluetooth sockets to trigger memory corruption or undefined behavior in the kernel's L2CAP cleanup logic, potentially resulting in a kernel crash (denial of service) or arbitrary code execution at the kernel level. The confidentiality, integrity, and availability impacts are all rated High, meaning a successful exploit could grant full control over the affected system. Lateral movement is possible if the attacker leverages kernel-level access to escalate privileges or pivot within the environment (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to create Bluetooth sockets, which limits the attack surface compared to remote vulnerabilities.

1. Gain local access: Obtain a local user account on a vulnerable Linux system with Bluetooth socket creation privileges (e.g., via CAP_NET_RAW or membership in the bluetooth group).
2. Identify vulnerable kernel version: Confirm the running kernel is within an affected version range (e.g., 5.10.265–5.10.272, 6.1.183–6.1.190, etc.) using uname -r.
3. Set up concurrent socket operations: Write a multithreaded or multiprocess program that opens a Bluetooth L2CAP socket and concurrently calls connect() (triggering l2cap_chan_connect()) in one thread and bind() (triggering l2cap_sock_bind()) in another thread, racing to violate the l2cap_chan/l2cap_conn linkage invariant.
4. Trigger the TOCTOU race: Time the concurrent operations so that Task 1 sets chan->state = BT_CONNECT while Task 2 sets chan->state = BT_BOUND, causing l2cap_sock_connect() to call __l2cap_chan_add() a second time on the same channel.
5. Achieve impact: The double-add corrupts kernel memory structures used during L2CAP channel cleanup, potentially causing a kernel panic (denial of service) or, with further exploitation primitives, arbitrary kernel code execution (GitHub Advisory).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing WARN_ON_ONCE triggered in __l2cap_chan_add, or kernel oops/panic traces referencing l2cap_chan_del, l2cap_chan_connect, or l2cap_sock_bind.
• Process: Unusual processes repeatedly opening and racing Bluetooth L2CAP sockets (AF_BLUETOOTH, BTPROTO_L2CAP), especially from non-privileged users or unexpected binaries.
• Network: Anomalous Bluetooth connection attempts or bind operations from unexpected processes visible via ss -x or Bluetooth monitoring tools.
• File System: Presence of custom exploit binaries or scripts in user home directories or /tmp that interact with Bluetooth socket APIs.

Upgrade to a patched Linux kernel version: 5.10.273 or later, 5.15.224 or later, 6.1.191 or later, 6.6.161 or later, 6.12.115 or later, 6.18.60 or later, 7.2.14 or later, or 7.3.1 or later (GitHub Advisory, Red Hat). As a workaround where Bluetooth is not required, restrict or disable Bluetooth socket creation by removing the bluetooth kernel module (modprobe -r bluetooth) or using AppArmor/SELinux policies to deny CAP_NET_RAW to untrusted users. Distributions such as Red Hat are tracking this via their security advisories and should be consulted for distribution-specific guidance (Red Hat Bugzilla).