SUSE CVE-2026-64404

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in isoconnbigsync isoconnbigsync drops the socket lock to call hcigetroute and then re-acquires it, but dereferences isopisk-conn-hcon afterwards without re-checking that conn is still...

CVE-2026-64404

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in isoconnbigsync isoconnbigsync drops the socket lock to call hcigetroute and then re-acquires it, but dereferences isopisk-conn-hcon afterwards without re-checking that conn is still...

CVE-2026-64404 Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in isoconnbigsync isoconnbigsync drops the socket lock to call hcigetroute and then re-acquires it, but dereferences isopisk-conn-hcon afterwards without re-checking that conn is still...

CVE-2026-64404 Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in isoconnbigsync isoconnbigsync drops the socket lock to call hcigetroute and then re-acquires it, but dereferences isopisk-conn-hcon afterwards without re-checking that conn is still...

CVE-2026-64404

CVE-2026-64404 concerns the Linux kernel Bluetooth ISO stack. The vulnerability arises in iso_conn_big_sync(): it drops the socket lock to call hci_get_route(), then re-acquires the lock but may dereference iso_pi(sk)->conn->hcon without re-checking that conn is still valid. While the lock ...

PT-2026-64625

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in iso conn big sync iso conn big sync drops the socket lock to call hci get route and then re-acquires it, but dereferences iso pisk-conn-hcon afterwards without re-checking that conn is...

CVE-2026-63871

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. This vulnerability, a data-race, occurs because certain functions access socket-related data without proper synchronization. Specifically, isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync can read critical fields while...

CVE-2026-63946

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream subsystem. This vulnerability, known as a Use-After-Free, occurs because the system attempts to use a memory area after it has been released, which can lead to unpredictable behavior. A malicious actor could potentially explo...

SUSE CVE-2026-63945

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-63945

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream subsystem. A race condition exists where the isosockcleartimer function can access connection data without proper locking, while another function, isoconndel, concurrently modifies the same data. This can lead to a NULL point...

Linux Distros Unpatched Vulnerability : CVE-2026-64128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT...

CVE-2026-63945

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-63946

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...

CVE-2026-64128

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT branch of isorecv guards against a missing ISOSTART by checking...

EUVD-2026-45813

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT branch of isorecv guards against a missing ISOSTART by checking...

CVE-2026-63871

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on isopi fields in hcigetroute calls isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync call hcigetroute using isopisk-dst, isopisk-src, and isopisk-srctype without holding locksock. Thes...

EUVD-2026-45719

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...

CVE-2026-63946

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...

CVE-2026-63945 Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-63945

CVE-2026-63945 affects the Linux kernel Bluetooth ISO code. The vulnerability arises when iso_sock_clear_timer() reads iso_pi(sk)->conn twice without holding the socket lock, while iso_chan_del() may NULL the connection under lock_sock, creating a window where the reference can be dropped and ...