CVE-2026-72337

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...

UBUNTU-CVE-2026-72336

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before reading hcon-l2capdata and before lowpancontrolwrite later dereferences...

UBUNTU-CVE-2026-72337

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...

CVE-2026-72336

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before reading hcon-l2capdata and before lowpancontrolwrite later dereferences...

EUVD-2026-59236

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...

CVE-2026-72337

CVE-2026-72337 : Linux kernel memory safety issue in Bluetooth 6lowpan handling. The flaw stems from lowpan_enable_set() allocating a temporary work item and scheduling do_enable_set() on system_wq, while the debugfs write returns and the worker may run later, potentially operating on stale state...

CVE-2026-72337 Bluetooth: 6lowpan: avoid untracked enable work

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...

CVE-2026-72337 Bluetooth: 6lowpan: avoid untracked enable work

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...

EUVD-2026-59235

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before reading hcon-l2capdata and before lowpancontrolwrite later dereferences...

CVE-2026-72336 Bluetooth: 6lowpan: hold L2CAP conn across debugfs control

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before reading hcon-l2capdata and before lowpancontrolwrite later dereferences...

CVE-2026-72336 Bluetooth: 6lowpan: hold L2CAP conn across debugfs control

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before reading hcon-l2capdata and before lowpancontrolwrite later dereferences...

CVE-2026-72336

CVE-2026-72336 — Linux kernel, Bluetooth 6lowpan L2CAP hold across debugfs control Root cause: get_l2cap_conn() looks up an LE hci_conn under hdev protection, then drops protection before reading hcon->l2cap_data and before lowpan_control_write() dereferences conn->hcon, allowing a disconne...

PT-2026-72524

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control get l2cap conn looks up an LE hci conn under hdev protection, but then drops that protection before reading hcon-l2cap data and before lowpan control write later...

PT-2026-72525

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpan enable set allocates a temporary work item and schedules do enable set on system wq, then returns to debugfs. The debugfs active operation has ended at that point, but the...

Linux Distros Unpatched Vulnerability : CVE-2026-72336

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before...

Linux kernel 6LoWPAN: off-by-one in multicast context address compression leaks a stack byte

Linux kernel 6LoWPAN: off-by-one in multicast context address compression leaks a stack byte Vulnerability Overview The Linux kernel 6LoWPAN IPHC multicast context address compression path contains an off-by-one error and uses a wrong memcpy offset, corrupting the RIID field of compressed multica...

Linux kernel 6lowpan: NHC entry use-after-free on error path

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

SUSE CVE-2026-63991

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: check skbclone return value in sendmcastpkt The skbclone function can return NULL if memory allocation fails. sendmcastpkt calls skbclone without checking the return value, which can lead to a NULL pointer...

CVE-2026-63991

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: check skbclone return value in sendmcastpkt The skbclone function can return NULL if memory allocation fails. sendmcastpkt calls skbclone without checking the return value, which can lead to a NULL pointer...

Linux Distros Unpatched Vulnerability : CVE-2025-40282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth 6lowpan.c netdev has headerops, so it must set link-local header for RX skb, otherwise...