CVE-2026-98460 Bluetooth: hci_sock: reject out-of-range OCF values

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submi...

CVE-2026-98460

A vulnerability exists in the Linux kernel 's Bluetooth hci_sock component. The raw HCI socket security filter provides 128 OCF bits per supported OGF but masks the 10-bit OCF with 127 before command lookup. This allows an unprivileged socket to submit a reserved OCF that aliases an allowlisted c...

EUVD-2026-103700

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submi...

CVE-2026-98459 Bluetooth: ISO: balance the parent hold in hci_bind_bis()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hcibindbis hciconnlink takes a lifetime reference to its parent with hciconnget, but only takes an operational hold on the child. hciconnunlink later balances both a hold and a reference...

CVE-2026-98459 Bluetooth: ISO: balance the parent hold in hci_bind_bis()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hcibindbis hciconnlink takes a lifetime reference to its parent with hciconnget, but only takes an operational hold on the child. hciconnunlink later balances both a hold and a reference...

CVE-2026-98459

A vulnerability in the Linux kernel Bluetooth stack allows for a potential use-after-free or premature disconnection. The issue resides in hci_bind_bis() , where the function obtains a parent pointer from hci_conn_hash_lookup_big() without taking an operational hold. Because hci_conn_unlink() lat...

EUVD-2026-103699

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hcibindbis hciconnlink takes a lifetime reference to its parent with hciconnget, but only takes an operational hold on the child. hciconnunlink later balances both a hold and a reference...

CVE-2026-98458 Bluetooth: ISO: release unused CIS holds after channel attach

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hcibindcis and hciconnectcis return one hciconn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by isoconnfree. Ther...

CVE-2026-98458 Bluetooth: ISO: release unused CIS holds after channel attach

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hcibindcis and hciconnectcis return one hciconn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by isoconnfree. Ther...

CVE-2026-98458

The Linux kernel Bluetooth ISO layer contains a vulnerability where hci_bind_cis() and hci_connect_cis() return an hci_conn hold that may remain unused. Specifically, the hold is not released when iso_chan_add() returns success for an already attached socket (idempotent case) or returns -EBUSY wh...

EUVD-2026-103698

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hcibindcis and hciconnectcis return one hciconn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by isoconnfree. Ther...

CVE-2026-98457 Bluetooth: L2CAP: validate frame length before control and FCS access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

CVE-2026-98457 Bluetooth: L2CAP: validate frame length before control and FCS access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

CVE-2026-98457

A vulnerability in the Linux kernel Bluetooth stack allows for an out-of-bounds read . The l2cap_data_rcv() function fails to verify the presence of two-byte or four-byte control fields before unpacking them, which can be triggered by short ERTM or streaming-mode frames. Additionally, when CRC16 ...

EUVD-2026-103697

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

CVE-2026-98456 Bluetooth: mgmt: fix race in read_unconf_index_list()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98456 Bluetooth: mgmt: fix race in read_unconf_index_list()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98456

A race condition exists in the Linux kernel Bluetooth management component within the read_unconf_index_list() function. The vulnerability occurs because hci_dev_list_lock stabilizes list membership but fails to serialize per-device flags during asynchronous controller setup. A worker can transit...

EUVD-2026-103696

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98455 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...