DEBIAN-CVE-2026-99239: High severity debian/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated: [Task 1] [Task 2] l2capchanconnect l2capsockbind l2capchanlock locksock l2capstatechange if (sk->skstate != BTOPEN) chan->state = BTCONNECT l2capsockstatechangecb chan->state = BTBOUND sk->skstate = BTBOUND locksock <------------------ releasesock sk->skstate = BTCONNECT l2capsockconnect() does not check sk->skstate, so since chan->state is now BTBOUND, subsequent connect() ends up with second l2capchanadd. Explicitly document and check the invariant in l2capchanadd with WARNONONCE. The only callsite where it could be hit is l2capchanconnect, so add pre-check there to avoid relying on chan->state. chan->state read/write is not properly guarded currently so there can be other TOCTOUC problems. Add l2caplockchan in l2capsockbind() to guard chan->state write.