EUVD-2026-67542

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

CVE-2026-80666 Bluetooth: sco: Fix a race condition in sco_sock_timeout()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

CVE-2026-80666

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

SUSE CVE-2026-72333

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee "Bluetooth: L2CAP: Fix not tracking outstanding TX ident" changed ident allocation to use an IDA, releasing idents in l2capputident when the...

EUVD-2026-67297

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may b...

CVE-2026-5706

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may b...

PT-2026-83021

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where ISO sockets may dereference the hcon reference after the iso conn del function has been called. This occurs because the clearing...

PT-2026-86700

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci connect acl/le sync callbacks There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that...

CVE-2026-80666: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

CVE-2026-5706: Improper Handling of Length Parameter Inconsistency

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may b...

PT-2026-82966

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.13.0-rc4 Description A race condition exists in the Bluetooth SCO component. The function sco sock timeout runs asynchronously and acquires a socket lock. If a socket is closing while the timer is active, the...

CVE-2026-80692: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-80683: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

PT-2026-82983

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth SCO Synchronous Connection-Oriented implementation where the sco conn del function drops a reference it does not own. This occurs because the socket stor...

PT-2026-82992

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF condition exists in the Bluetooth component. This occurs when the conn object is freed while the hci sync task is still running. The issue is specifically related to...

PT-2026-86719

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso conn After iso conn del, ISO sockets should not dereference the hcon any more. Currently, clearing iso conn::hcon relies on iso conn del releasing the last reference to th...

CVE-2026-80721: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in isoconn After isoconndel, ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel releasing the last reference to the...

Linux Distros Unpatched Vulnerability : CVE-2026-80692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount t...

Linux Distros Unpatched Vulnerability : CVE-2026-80721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: ensure no dangling hcon references in isoconn After isoconndel, ISO sockets should not dereference the hcon any more. Currently, clearing...

CVE-2026-5706 Buffer overflow in Bluetooth Mesh SDK when handling extended advertisements

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may b...