{
  "cveId": "CVE-2026-99239",
  "url": "https://patchblox.com/security/cve/CVE-2026-99239",
  "summary": "CVE-2026-99239 is fixed in linux on 1 platform by DEBIAN-CVE-2026-99239 (version 6.12.115-1), released November 3, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: L2CAP: refuse __l2cap_chan_add if cha...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn  l2cap_chan may be linked to l2cap_conn at most once. This is assumed in several places, eg l2cap_chan_del cleanup.  There is a TOCTOU race where the invariant is violated:      [Task 1]                          [Task 2]     l2cap_chan_connect                l2cap_sock_bind       l2cap_chan_lock                   lock_sock       l2cap_state_change                if (sk-\u003Esk_state != BT_OPEN)         chan-\u003Estate = BT_CONNECT         l2cap_sock_state_change_cb      chan-\u003Estate = BT_BOUND                                         sk-\u003Esk_state = BT_BOUND           lock_sock \u003C------------------ release_sock           sk-\u003Esk_state = BT_CONNECT  l2cap_sock_connect() does not check sk-\u003Esk_state, so since chan-\u003Estate is now BT_BOUND, subsequent connect() ends up with second __l2cap_chan_add.  Explicitly document and check the invariant in __l2cap_chan_add with WARN_ON_ONCE. The only callsite where it could be hit is l2cap_chan_connect, so add pre-check there to avoid relying on chan-\u003Estate. chan-\u003Estate read/write is not properly guarded currently so there can be other TOCTOUC problems.  Add l2cap_lock_chan in l2cap_sock_bind() to guard chan-\u003Estate write.",
  "published": "2026-11-02T16:17:49Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00126,
  "epssPercentile": 0.02302,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-1",
      "fix": "DEBIAN-CVE-2026-99239",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99239",
      "released": "2026-11-03T18:58:21Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}