{"id":"CVE-2026-99239","aliases":[],"cve":{"records":[{"id":"CVE-2026-99239","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T10:25:14.403Z","published":"2026-11-02T16:06:43.262Z","modified":"2026-11-03T19:13:06.554Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-11-03T19:13:06.554Z"}],"references":[{"url":"https://git.kernel.org/stable/c/85cc289eb08afa975375f838187369e68b429ee0","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/820579652b24ce277e0097cd65b42bd9b7b8bf07","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/e618d928ec7f88cbeadfa3542adcac40f474e629","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/52fe88e4ef87311eee32b45c65603e7c69e75e7d","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/10c705dd706aa93164ba41f2566f15206d6c178e","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/73820561d8cbfd3364a29b8fa77f1707f26029da","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/d3afd7803f9bc2a8c4270199497b60158b2fc647","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/86b55991d3cd690e73c5ef8d20b75ae4905b357a","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.265","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.216","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.183","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.145","versionEndExcluding":"6.6.161"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.97","versionEndExcluding":"6.12.115"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.39","versionEndExcluding":"6.18.60"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2","versionEndExcluding":"7.2.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2","versionEndExcluding":"7.3.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2","versionEndExcluding":"7.4-rc1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1.4"}]}]}]}],"prioritization":[]},"title":"Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn\n\nl2cap_chan may be linked to l2cap_conn at most once. This is assumed in\nseveral places, eg l2cap_chan_del cleanup.\n\nThere is a TOCTOU race where the invariant is violated:\n\n    [Task 1]                          [Task 2]\n    l2cap_chan_connect                l2cap_sock_bind\n      l2cap_chan_lock                   lock_sock\n      l2cap_state_change                if (sk->sk_state != BT_OPEN)\n        chan->state = BT_CONNECT\n        l2cap_sock_state_change_cb      chan->state = BT_BOUND\n                                        sk->sk_state = BT_BOUND\n          lock_sock <------------------ release_sock\n          sk->sk_state = BT_CONNECT\n\nl2cap_sock_connect() does not check sk->sk_state, so since chan->state\nis now BT_BOUND, subsequent connect() ends up with second\n__l2cap_chan_add.\n\nExplicitly document and check the invariant in __l2cap_chan_add with\nWARN_ON_ONCE. The only callsite where it could be hit is\nl2cap_chan_connect, so add pre-check there to avoid relying on\nchan->state. chan->state read/write is not properly guarded currently so\nthere can be other TOCTOUC problems.\n\nAdd l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write.","score":7.8,"severity":"high","published":"2026-11-02T16:06:43.262Z","modified":"2026-11-03T19:13:06.554Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"8f90405a4a6f1f1880dc07996b47bf57c712bd8a","status":"affected","lessThan":"85cc289eb08afa975375f838187369e68b429ee0","versionType":"git"},{"version":"32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b","status":"affected","lessThan":"820579652b24ce277e0097cd65b42bd9b7b8bf07","versionType":"git"},{"version":"8922c7940bae9ce4b1736dddb6362370793835c2","status":"affected","lessThan":"e618d928ec7f88cbeadfa3542adcac40f474e629","versionType":"git"},{"version":"91047a4396a8b1857a6f712a90cf33ec0012b189","status":"affected","lessThan":"fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2","versionType":"git"},{"version":"0b0e2bf39cf99e458d991b9df253727e036a7d7d","status":"affected","lessThan":"52fe88e4ef87311eee32b45c65603e7c69e75e7d","versionType":"git"},{"version":"d3b739db5dc6f688a60d56da872fabaf65246032","status":"affected","lessThan":"10c705dd706aa93164ba41f2566f15206d6c178e","versionType":"git"},{"version":"b66774b48dd98f07254951f74ea6f513efe7ff8b","status":"affected","lessThan":"73820561d8cbfd3364a29b8fa77f1707f26029da","versionType":"git"},{"version":"b66774b48dd98f07254951f74ea6f513efe7ff8b","status":"affected","lessThan":"d3afd7803f9bc2a8c4270199497b60158b2fc647","versionType":"git"},{"version":"b66774b48dd98f07254951f74ea6f513efe7ff8b","status":"affected","lessThan":"86b55991d3cd690e73c5ef8d20b75ae4905b357a","versionType":"git"},{"version":"50c38d9f42a529691e4e67ea9cedf4f0bfc8d277","status":"affected","versionType":"git"},{"version":"5.10.265","status":"affected","lessThan":"5.10.273","versionType":"semver"},{"version":"5.15.216","status":"affected","lessThan":"5.15.224","versionType":"semver"},{"version":"6.1.183","status":"affected","lessThan":"6.1.191","versionType":"semver"},{"version":"6.6.145","status":"affected","lessThan":"6.6.161","versionType":"semver"},{"version":"6.12.97","status":"affected","lessThan":"6.12.115","versionType":"semver"},{"version":"6.18.39","status":"affected","lessThan":"6.18.60","versionType":"semver"},{"version":"7.1.4","status":"affected","lessThan":"7.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-99239"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"7.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.2","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.161","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.115","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.60","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.14","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3.1","status":"unaffected","lessThanOrEqual":"7.3.*","versionType":"semver"},{"version":"7.4-rc1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-99239"}],"remediation":[],"references":["https://git.kernel.org/stable/c/85cc289eb08afa975375f838187369e68b429ee0","https://git.kernel.org/stable/c/820579652b24ce277e0097cd65b42bd9b7b8bf07","https://git.kernel.org/stable/c/e618d928ec7f88cbeadfa3542adcac40f474e629","https://git.kernel.org/stable/c/fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2","https://git.kernel.org/stable/c/52fe88e4ef87311eee32b45c65603e7c69e75e7d","https://git.kernel.org/stable/c/10c705dd706aa93164ba41f2566f15206d6c178e","https://git.kernel.org/stable/c/73820561d8cbfd3364a29b8fa77f1707f26029da","https://git.kernel.org/stable/c/d3afd7803f9bc2a8c4270199497b60158b2fc647","https://git.kernel.org/stable/c/86b55991d3cd690e73c5ef8d20b75ae4905b357a"],"sources":[{"name":"CVE","id":"CVE-2026-99239","modified":"2026-11-03T19:13:06.554Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-99239"}],"assessments":[{"source":"Linux","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"observedAt":"2026-11-03T19:50:52.320Z","kev":{"status":"not-listed","checkedAt":"2026-11-06T21:20:33.816Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-02T16:40:35.265Z","attemptedAt":"2026-11-02T16:40:35.265Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-02T16:40:34.767Z","attemptedAt":"2026-11-02T16:40:34.767Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-02T16:40:35.510Z","attemptedAt":"2026-11-02T16:40:35.510Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-02T16:40:37.046Z","attemptedAt":"2026-11-02T16:40:37.046Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-99239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99239","modified":"2026-11-02T16:17:49.540","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-02T16:40:35.265Z"}],"aiSummary":{"text":"The Linux kernel has a vulnerability in the Bluetooth L2CAP protocol, where a TOCTOU race condition can cause an invariant to be violated, potentially leading to issues. The affected versions include various Linux kernel versions. Local access may be required to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-03T20:01:15.548Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-99239"}]}}