{"metadata": {"vulnerability": "CVE-2026-99009", "count": 22, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 14}}, "data": [{"timestamp": "2026-09-25T10:25:14.385Z", "date_only": false, "value": "2026-09-25T10:25:14.385Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99009", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:20:34.301Z", "date_only": false, "value": "2026-10-23T12:20:34.301Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99009", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99009", "record": "UBUNTU-CVE-2026-99009", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:23Z", "date_only": false, "value": "2026-10-23T13:17:23Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5RPP-JH2W-VM6P", "record": "GHSA-5RPP-JH2W-VM6P", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-23T13:17:23.470Z", "date_only": false, "value": "2026-10-23T13:17:23.470", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99009", "record": "FKIE_CVE-2026-99009", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:46:11.977Z", "date_only": false, "value": "2026-10-23T13:46:11.977397Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490527201676758", "record": "CVE-2026-99009", "field": "creation_timestamp", "uuid": "1d31cf78-58db-45ee-a535-6bb2069a3dda", "content": "CVE-2026-99009 Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: RFCOMM: connect the session socket without rfcomm_mutex\nAn RFCOMM connect() issued while a BR/EDR link is being authenticatedmakes lockdep report a circular dependency, and the reported cycle is areal AB/BA between rfcomm_mutex and hdev->lock.\nrfcomm_security_cfm() is called from the HCI event path, which alreadyholds hdev->lock:\n  hci_rx_work()    hci_event_packet()      hci_cc_read_enc_key_size()   [hdev->lock]        hci_encrypt_cfm()          [hci_cb_list_lock]          rfcomm_security_cfm()    [rfcomm_mutex]\nwhile an RFCOMM connect() from userspace takes the same two locks theother way round:\n  rfcomm_sock_connect()    rfcomm_dlc_open()              [rfcomm_mutex]      __rfcomm_dlc_open()        rfcomm_session_create()          kernel_connect()            l2cap_sock_connect()              l2cap_chan_connect() [hdev->lock]\n  WARNING: possible circular locking dependency detected  kworker/u131:1/1128 is trying to acquire lock:  rfcomm_mutex, at: rfcomm_security_cfm+0x31/0x3e0 [rfcomm]  but task is already holding lock:  hci_cb_list_lock, at: hci_cc_read_enc_key_size+0x1d2/0xcc0  Chain exists of:    rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock\nhci_auth_complete_evt() and hci_encrypt_change_evt() reach the callbackthe same way.\nBoth orders have to be seen in the same boot, which is why a BR/EDRconnection alone is not enough to show it: a session set up by theremote side is created by rfcomm_accept_connection() in krfcommd, whichcalls kernel_accept() and never takes hdev->lock under rfcomm_mutex.Connecting a device that authenticates and encrypts the link and thencalling connect() on an RFCOMM socket towards any address - the connectdoes not have to succeed, the order is recorded before the page timeout- reports it every time.\nOnly the session socket has to be connected with the lock held, and itdoes not: nothing else can see the socket before it is put on thesession list.  So connect it first and take rfcomm_mutex afterwards,which removes the rfcomm_mutex -> hdev->lock order for good, ratherthan keeping the HCI event path out of rfcomm_mutex.\nrfcomm_session_create() becomes rfcomm_session_connect(), which returnsthe connected socket without touching the session list, andrfcomm_dlc_open() adds the session once it holds the lock again.  Ifanother opener added a session for the same pair while this socket wasconnecting, that session is used and this socket is dropped.__rfcomm_dlc_open() now takes the session it should use, and its statecheck runs after the lock is re-acquired, so a DLC that was opened orclosed in the meantime is still handled.\nOver an existing ACL link the connection can complete before thesession reaches the list, and the wakeup from the socket callback isthen lost, so krfcommd is woken once the session is visible.\nConnecting without the lock opens a window in which the socket can beclosed.  The DLC is not on a session yet, so rfcomm_dlc_close() findsnothing to do and returns without touching it, and rfcomm_dlc_open()would then attach a DLC whose owner is gone.  rfcomm_dlc_close() nowmarks such a DLC with RFCOMM_CLOSED, and rfcomm_dlc_open() checks themark once it holds rfcomm_mutex again and drops the socket instead ofattaching the DLC.  The mark is cleared when an open starts, so a DLCthat is reused is not affected.  This covers both callers ofrfcomm_dlc_open(), the socket and the tty layer.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99009https://git.kernel.org/stable/c/4dc3d5a004b8fd59f3c905631dbb18cb601b1b41https://git.kernel.org/stable/c/d2206e8c78be69d21d4f5343c3e99fbaeef41cbbhttps://git.kernel.org/stable/c/cc7732b8549ecb6f02457edeb8db1f6d255e381chttps://git.kernel.org/stable/c/f492de11b325446b0b11bc2eb86e1f546eaa61b6https://git.kernel.org/stable/c/ac022970e9fb0a5f7e7d1f6c8e104c1ed924dd1c#kernel #Linux#CVE_2026_99009#bot", "url": "https://infosec.exchange/users/cve/statuses/117490527201676758"}, {"timestamp": "2026-10-23T15:31:34Z", "date_only": false, "value": "2026-10-23T15:31:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5RPP-JH2W-VM6P", "record": "GHSA-5RPP-JH2W-VM6P", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-25T01:03:19Z", "date_only": false, "value": "2026-10-25T01:03:19.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99009", "record": "MSRC_CVE-2026-99009", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-25T01:03:19Z", "date_only": false, "value": "2026-10-25T01:03:19.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99009", "record": "MSRC_CVE-2026-99009", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-25T01:03:19Z", "date_only": false, "value": "2026-10-25T01:03:19.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99009", "record": "MSRC_CVE-2026-99009", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-25T01:04:15Z", "date_only": false, "value": "2026-10-25T01:04:15.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99009", "record": "MSRC_CVE-2026-99009", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-26T14:46:11Z", "date_only": false, "value": "2026-10-26T14:46:11.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99009", "record": "MSRC_CVE-2026-99009", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-28T06:07:55.292Z", "date_only": false, "value": "2026-10-28T06:07:55.292646Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99009", "record": "BELL-CVE-2026-99009", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T06:31:45.103Z", "date_only": false, "value": "2026-10-28T06:31:45.103767Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99009", "record": "BELL-CVE-2026-99009", "field": "modified"}, {"timestamp": "2026-10-30T12:40:54.430Z", "date_only": false, "value": "2026-10-30T12:40:54.430Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99009", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T12:40:54.430Z", "date_only": false, "value": "2026-10-30T12:40:54.430Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99009", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T13:21:35.640Z", "date_only": false, "value": "2026-10-30T13:21:35.640", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99009", "record": "FKIE_CVE-2026-99009", "field": "lastModified"}, {"timestamp": "2026-10-30T15:34:14Z", "date_only": false, "value": "2026-10-30T15:34:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5RPP-JH2W-VM6P", "record": "GHSA-5RPP-JH2W-VM6P", "field": "modified"}, {"timestamp": "2026-10-30T19:03:31Z", "date_only": false, "value": "2026-10-30T19:03:31Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99009", "record": "UBUNTU-CVE-2026-99009", "field": "modified"}, {"timestamp": "2026-11-01T15:03:35Z", "date_only": false, "value": "2026-11-01T15:03:35.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99009", "record": "MSRC_CVE-2026-99009", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-11-01T15:03:35Z", "date_only": false, "value": "2026-11-01T15:03:35.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99009", "record": "MSRC_CVE-2026-99009", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-11-02T08:02:48.178Z", "date_only": false, "value": "2026-11-02T08:02:48.178Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99009", "record": "MSRC_CVE-2026-99009", "field": "document.tracking.generator.date"}], "metrics": {"as_of": "2026-11-02T16:51:01.197Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:20:34.301Z", "date_only": false, "value": "2026-10-23T12:20:34.301Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99009", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:20:34.301Z", "date_only": false, "value": "2026-10-23T12:20:34.301Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99009", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 880226.896301, "hours": 244.50747119472223, "days": 10.187811299780092, "min_seconds": 880226.896301, "max_seconds": 880226.896301, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:20:34.301Z", "date_only": false, "value": "2026-10-23T12:20:34.301Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99009", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-02T16:51:01.197Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}