{"metadata": {"vulnerability": "CVE-2026-99012", "count": 21, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 13}}, "data": [{"timestamp": "2026-09-25T10:25:14.385Z", "date_only": false, "value": "2026-09-25T10:25:14.385Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99012", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:20:37.472Z", "date_only": false, "value": "2026-10-23T12:20:37.472Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99012", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99012", "record": "UBUNTU-CVE-2026-99012", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:23Z", "date_only": false, "value": "2026-10-23T13:17:23Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-G55X-63CP-X552", "record": "GHSA-G55X-63CP-X552", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:23.867Z", "date_only": false, "value": "2026-10-23T13:17:23.867", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99012", "record": "FKIE_CVE-2026-99012", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:48:13.428Z", "date_only": false, "value": "2026-10-23T13:48:13.428710Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490535158678219", "record": "CVE-2026-99012", "field": "creation_timestamp", "uuid": "95b1868a-550e-48ad-8e3d-749bf065b236", "content": "CVE-2026-99012 Bluetooth: ISO: Serialize concurrent connect calls In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: ISO: Serialize concurrent connect calls\niso_sock_connect() checks the socket state before taking the socket lockand drops the lock again before setting up a connection. Two callers canboth pass the admission check while the socket is open or bound.\nCaller A can copy its destination for route selection, then caller B canreplace the socket destination before A binds or connects the CIS. Athen uses B's destination with the route selected for its own request.B can also proceed after A attaches a connection and sets BT_CONNECT.For deferred BIS setup, B can bind a second BIS and overwriteiso_pi(sk)->conn, leaving the first connection's reference and conn->skback-pointer stranded. Concurrent CIS connects can likewise replace thesocket's connection. Later teardown only detaches the current connection,so a callback on the old connection can race with socket release andaccess a freed socket.\nKASAN reported:\n  BUG: KASAN: slab-use-after-free in iso_sock_hold+0xf7/0x1b0  Call Trace:   iso_sock_hold+0xf7/0x1b0   iso_conn_del+0x7b/0x1d0   iso_connect_cfm+0x186/0x16a0   hci_conn_failed+0x154/0x280   hci_abort_conn_sync+0x3dc/0x7d0   hci_cmd_sync_work+0x173/0x300\n  Allocated by task 121:   sk_alloc+0x2b/0x6d0   bt_sock_alloc+0x29/0x370   iso_sock_alloc.constprop.0+0x19/0x300   iso_sock_create+0x94/0x100\n  Freed by task 121:   kfree+0x121/0x3c0   __sk_destruct+0x42b/0x540   iso_sock_release+0x29d/0x340   __sock_release+0xa1/0x260\nCheck admission under the socket lock and mark the connect operation inprogress before publishing its destination. Keep that flag set acrossroute lookup and connection setup, rejecting another connect with-EBADFD before it can change the destination or attach a connection.Clear the flag after either helper returns, including on failure, so afailed setup can be retried.\nA separate flag is needed because the socket lock must be released beforeacquiring the HCI device lock, while BT_CONNECT requires an attachedconnection. Keep the existing state transitions and the deferred CIScompletion through iso_sock_recvmsg().\nReject an existing socket attachment in __iso_chan_add() before takinga new reference or publishing either pointer, so every caller preservesthe connection association. Keep the same-socket, same-connection successcase for deferred CIS setup. Reject an attached socket before BIS setupso a reusable BIS is not claimed before the attachment is rejected.\nIn CIS setup, reject a different HCI connection before iso_conn_add()and drop the per-attempt HCI hold directly. An unowned iso_conn may stillcarry another reference after detachment, so its destruction cannot berelied on to release that hold.\niso_listen_bis() creates a fresh PA HCI/ISO pair under the device lock,so the temporary iso_conn_put() frees the ISO candidate and drops itsHCI hold on rejection. iso_conn_ready() uses a freshly allocated,unpublished child with no connection, making the socket-side rejectionunreachable.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99012https://git.kernel.org/stable/c/9b6ed57eb8c892ee7566b8c1bd06fdd0053b53dehttps://git.kernel.org/stable/c/1adcfe232c0f58890c2538211a841100ad0512bdhttps://git.kernel.org/stable/c/c6489a3a0ac8c07f64cb5b44f005bc518f1048achttps://git.kernel.org/stable/c/3728f6b0d5990c0d500e929ba10baf93bee24f5ehttps://git.kernel.org/stable/c/e32d80293a0e1a160d5e5101daa8c82148c07510#kernel #Linux#CVE_2026_99012#bot", "url": "https://infosec.exchange/users/cve/statuses/117490535158678219"}, {"timestamp": "2026-10-23T15:31:34Z", "date_only": false, "value": "2026-10-23T15:31:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-G55X-63CP-X552", "record": "GHSA-G55X-63CP-X552", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:03:24Z", "date_only": false, "value": "2026-10-25T01:03:24.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99012", "record": "MSRC_CVE-2026-99012", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:03:24Z", "date_only": false, "value": "2026-10-25T01:03:24.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99012", "record": "MSRC_CVE-2026-99012", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:04:23Z", "date_only": false, "value": "2026-10-25T01:04:23.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99012", "record": "MSRC_CVE-2026-99012", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-26T14:46:20Z", "date_only": false, "value": "2026-10-26T14:46:20.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99012", "record": "MSRC_CVE-2026-99012", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-28T01:49:55Z", "date_only": false, "value": "2026-10-28T01:49:55.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99012", "record": "MSRC_CVE-2026-99012", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-10-28T01:49:55Z", "date_only": false, "value": "2026-10-28T01:49:55.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99012", "record": "MSRC_CVE-2026-99012", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-28T06:07:55.469Z", "date_only": false, "value": "2026-10-28T06:07:55.469177Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99012", "record": "BELL-CVE-2026-99012", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T07:02:50.914Z", "date_only": false, "value": "2026-10-28T07:02:50.914Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99012", "record": "MSRC_CVE-2026-99012", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-10-30T12:40:56.601Z", "date_only": false, "value": "2026-10-30T12:40:56.601Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99012", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T12:40:56.601Z", "date_only": false, "value": "2026-10-30T12:40:56.601Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99012", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T13:21:37.110Z", "date_only": false, "value": "2026-10-30T13:21:37.110", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99012", "record": "FKIE_CVE-2026-99012", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-30T15:34:14Z", "date_only": false, "value": "2026-10-30T15:34:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-G55X-63CP-X552", "record": "GHSA-G55X-63CP-X552", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T19:03:32Z", "date_only": false, "value": "2026-10-30T19:03:32Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99012", "record": "UBUNTU-CVE-2026-99012", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T06:23:56.817Z", "date_only": false, "value": "2026-11-03T06:23:56.817008Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99012", "record": "BELL-CVE-2026-99012", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-04T01:25:59.398Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:20:37.472Z", "date_only": false, "value": "2026-10-23T12:20:37.472Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99012", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:20:37.472Z", "date_only": false, "value": "2026-10-23T12:20:37.472Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99012", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 997521.926174, "hours": 277.08942393722225, "days": 11.545392664050926, "min_seconds": 997521.926174, "max_seconds": 997521.926174, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:20:37.472Z", "date_only": false, "value": "2026-10-23T12:20:37.472Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99012", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-04T01:25:59.398Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}