CVE record · CVE-2026-99239

Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

CVSS 7.8 HighEPSS 0.0013 · 2nd percentile

Published by the CVE Program (CNA: Linux) at 2 Nov 2026, 16:06 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected 8f90405a4a6f1f1880dc07996b47bf57c712bd8a to before 85cc289eb08afa975375f838187369e68b429ee0 git affected 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b to before 820579652b24ce277e0097cd65b42bd9b7b8bf07 git affected 8922c7940bae9ce4b1736dddb6362370793835c2 to before e618d928ec7f88cbeadfa3542adcac40f474e629 git affected 91047a4396a8b1857a6f712a90cf33ec0012b189 to before fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2 git affected 0b0e2bf39cf99e458d991b9df253727e036a7d7d to before 52fe88e4ef87311eee32b45c65603e7c69e75e7d git affected d3b739db5dc6f688a60d56da872fabaf65246032 to before 10c705dd706aa93164ba41f2566f15206d6c178e git affected b66774b48dd98f07254951f74ea6f513efe7ff8b to before 73820561d8cbfd3364a29b8fa77f1707f26029da git affected b66774b48dd98f07254951f74ea6f513efe7ff8b to before d3afd7803f9bc2a8c4270199497b60158b2fc647 git affected b66774b48dd98f07254951f74ea6f513efe7ff8b to before 86b55991d3cd690e73c5ef8d20b75ae4905b357a git affected 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277 git affected 5.10.265 to before 5.10.273 semver affected 5.15.216 to before 5.15.224 semver and 5 more Other versions: unaffected
Linux	Linux	affected 7.2 unaffected before 7.2 semver unaffected 5.10.273 to 5.10., inclusive semver unaffected 5.15.224 to 5.15., inclusive semver unaffected 6.1.191 to 6.1., inclusive semver unaffected 6.6.161 to 6.6., inclusive semver unaffected 6.12.115 to 6.12., inclusive semver unaffected 6.18.60 to 6.18., inclusive semver unaffected 7.2.14 to 7.2., inclusive semver unaffected 7.3.1 to 7.3., inclusive semver unaffected 7.4-rc1 to *, inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-99239
CNA: Linux
Tags: Linux kernel
Published: 2 Nov 2026
Updated: 3 Nov 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.8	High	3.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CNA (Linux)

CISA KEV Not listed.
EPSS 0.0013, the 2nd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

2 Nov 2026, 16:06 UTC Confirmed by the CVE List
2 Nov 2026, 16:12 UTC First seen by agentprime
2 Nov 2026, 16:17 UTC Confirmed by NVD

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.