# Bluetooth: L2CAP: refuse \_\_l2cap_chan_add if chan already has conn

CVE record · `CVE-2026-99239`

- **Identifiers:** `CVE-2026-99239`
- **State:** Confirmed
- **Severity:** CVSS 7.8 High
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 2 Nov 2026
- **Updated:** 3 Nov 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 2 Nov 2026, 16:06 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `8f90405a4a6f1f1880dc07996b47bf57c712bd8a to before 85cc289eb08afa975375f838187369e68b429ee0` (git)
  - affected: `32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b to before 820579652b24ce277e0097cd65b42bd9b7b8bf07` (git)
  - affected: `8922c7940bae9ce4b1736dddb6362370793835c2 to before e618d928ec7f88cbeadfa3542adcac40f474e629` (git)
  - affected: `91047a4396a8b1857a6f712a90cf33ec0012b189 to before fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2` (git)
  - affected: `0b0e2bf39cf99e458d991b9df253727e036a7d7d to before 52fe88e4ef87311eee32b45c65603e7c69e75e7d` (git)
  - affected: `d3b739db5dc6f688a60d56da872fabaf65246032 to before 10c705dd706aa93164ba41f2566f15206d6c178e` (git)
  - affected: `b66774b48dd98f07254951f74ea6f513efe7ff8b to before 73820561d8cbfd3364a29b8fa77f1707f26029da` (git)
  - affected: `b66774b48dd98f07254951f74ea6f513efe7ff8b to before d3afd7803f9bc2a8c4270199497b60158b2fc647` (git)
  - affected: `b66774b48dd98f07254951f74ea6f513efe7ff8b to before 86b55991d3cd690e73c5ef8d20b75ae4905b357a` (git)
  - affected: `50c38d9f42a529691e4e67ea9cedf4f0bfc8d277` (git)
  - affected: `5.10.265 to before 5.10.273` (semver)
  - affected: `5.15.216 to before 5.15.224` (semver)
  - and 5 more
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `7.2`
  - unaffected: `before 7.2` (semver)
  - unaffected: `5.10.273 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.224 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.191 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.161 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.115 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.60 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.14 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3.1 to 7.3.*, inclusive` (semver)
  - unaffected: `7.4-rc1 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 7.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0013, the 2nd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

- 2 Nov 2026, 16:06 UTC: [Confirmed by the CVE List](https://www.cve.org/CVERecord?id=CVE-2026-99239)
- 2 Nov 2026, 16:12 UTC: First seen by agentprime
- 2 Nov 2026, 16:17 UTC: [Confirmed by NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-99239)

## Sources

- [CVE List: CVE-2026-99239](https://www.cve.org/CVERecord?id=CVE-2026-99239)
- [NVD: CVE-2026-99239](https://nvd.nist.gov/vuln/detail/CVE-2026-99239)

### References from the CNA

- <https://git.kernel.org/stable/c/85cc289eb08afa975375f838187369e68b429ee0>
- <https://git.kernel.org/stable/c/820579652b24ce277e0097cd65b42bd9b7b8bf07>
- <https://git.kernel.org/stable/c/e618d928ec7f88cbeadfa3542adcac40f474e629>
- <https://git.kernel.org/stable/c/fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2>
- <https://git.kernel.org/stable/c/52fe88e4ef87311eee32b45c65603e7c69e75e7d>
- <https://git.kernel.org/stable/c/10c705dd706aa93164ba41f2566f15206d6c178e>
- <https://git.kernel.org/stable/c/73820561d8cbfd3364a29b8fa77f1707f26029da>
- <https://git.kernel.org/stable/c/d3afd7803f9bc2a8c4270199497b60158b2fc647>
- <https://git.kernel.org/stable/c/86b55991d3cd690e73c5ef8d20b75ae4905b357a>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-99239>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-99239/>. Everything for agents: <https://agentprime.io/llms.txt>.