CVE-2026-80760

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

CVE-2026-80760 Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

EUVD-2026-71403

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

CVE-2026-80760 Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

CVE-2026-80759 Bluetooth: hci_aml: validate firmware segment lengths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciaml: validate firmware segment lengths amldownloadfirmware reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or...

CVE-2026-80759

CVE-2026-80759 affects the Linux kernel's Bluetooth HCI AML driver . The function aml_download_firmware() reads two lengths from the firmware header and uses them to build pointers before verifying that the header and segment data are actually present. A truncated or inconsistent firmware image c...

EUVD-2026-71402

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciaml: validate firmware segment lengths amldownloadfirmware reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or...

CVE-2026-80759

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciaml: validate firmware segment lengths amldownloadfirmware reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or...

kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...

PT-2026-85605

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci event: fix LE list UAF on reset hci cc reset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs reade...

Linux Distros Unpatched Vulnerability : CVE-2026-80764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers...

CVE-2026-80761: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname isosockgetname fills a struct sockaddriso in place and returns its size without clearing it first, so bytes it does not write are copied to user space from the kern...

CVE-2026-80764: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80760: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

CVE-2026-80762: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...

CVE-2026-80763: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

Linux Distros Unpatched Vulnerability : CVE-2026-80761

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: zero the sockaddr before returning it in getname isosockgetname fills a struct sockaddriso in place and returns its size without clearing it...

Linux Distros Unpatched Vulnerability : CVE-2026-80819

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any...