Linux Kernel EUVD-2026-115281

Requires a local, authenticated (PR:L) process on a host where the Linux Bluetooth stack and L2CAP socket support are present and reachable by the attacker (CONFIG_BT with L2CAP; access to AF_BLUETOOTH sockets). The concrete prerequisite stated in the description is a TOCTOU race: the attacker must interleave l2cap_chan_connect (which sets chan->state=BT_CONNECT) with l2cap_sock_bind (which sets chan->state=BT_BOUND) and then l2cap_sock_connect - which does not re-check sk->sk_state - so that __l2cap_chan_add is invoked a second time on a channel already linked to a conn. Limiting factors: exploitation is local only (AV:L, no network reach), needs the Bluetooth subsystem enabled and accessible, and depends on winning a narrow timing window between two tasks; there is no remote or unauthenticated path.

The input CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable, low-privilege flaw with full confidentiality, integrity and availability impact - the classic profile of a Linux-kernel memory-safety bug leading to local privilege escalation rather than a remote compromise. No EPSS score, KEV entry, SSVC exploitation field or POC indicator is present in the supplied data; the only references are eight git.kernel.org stable-tree fix commits, which are patch artifacts, not exploit code. The vuln.today decision label is 'this_week', i.e. a near-term but non-emergency priority, which is consistent with a local-only kernel race that has no evidence of active exploitation. One tension to flag: the supplied vector uses AC:L, yet the description explicitly characterizes the bug as a TOCTOU race between l2cap_chan_connect/l2cap_sock_bind/l2cap_sock_connect, and winning a race typically raises real-world attack complexity - my independent assessment therefore diverges on that metric (see assessed_cvss_vector). Net: a genuine local-EoL-class kernel issue worth patching within the vendor's normal stable cadence, not a drop-everything remote emergency; it is a high-CVSS issue whose real-world urgency is moderated by the local attack vector and race requirement.

A local unprivileged user running on a Linux host with the Bluetooth stack present creates L2CAP sockets and concurrently races bind() against connect() on the same channel, violating the 'one l2cap_chan linked to one l2cap_conn' invariant so that __l2cap_chan_add runs twice. The resulting corrupted channel/connection state (mishandled in cleanup paths such as l2cap_chan_del) can be driven toward memory corruption and local privilege escalation. No public exploit is identified in the provided data; the only references are kernel fix commits, and the trigger beyond the described TOCTOU race is not detailed in the available sources.