PT-2026-72987

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where the iso sock timeout function acquires lock sock. Synchronously disabling the timer while holding this lock can result in a...

Linux Distros Unpatched Vulnerability : CVE-2026-74511

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: mgmt: fix pending command UAF in EIR updates MGMTOPSETLOCALNAME is handled asynchronously on powered controllers and can run setnamesync. When the...

PT-2026-72963

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth management component during Extended Inquiry Response EIR updates. The MGMT OP SET LOCAL NAME command is handled asynchronously and can...

PT-2026-72959

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth HIDP HID over SDP implementation where the hidp process data function fails to validate the payload of numbered reports. When hidp get raw report waits f...

CVE-2026-74539: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...

PT-2026-72991

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where the iso sock getname function accesses iso pisk-conn without holding the required lock sock. This lack of proper locking can lea...

CVE-2026-72336: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before reading hcon-l2capdata and before lowpancontrolwrite later dereferences...

PT-2026-72524

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the Bluetooth 6LoWPAN implementation. The get l2cap conn function retrieves an LE hci conn under hdev protection but releases that protection before...

Linux Distros Unpatched Vulnerability : CVE-2026-74534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel...

CVE-2026-74528: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...

PT-2026-72522

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO handling where malformed ISO END or ISO CONT packets can cause system instability. If a controller sends a malformed sequence such as ISO START...

PT-2026-72980

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci past sync callback Avoids giving freed pointers to hci conn valid, which kmalloc may have reused. Hold refcount to avoid that...

PT-2026-72738

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth component. The hci unregister dev function fails to disable cmd timer and ncmd timer before the hci dev structure is freed. If a timeout...

PT-2026-72961

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue exists in the Bluetooth subsystem. The function hci find adv instance returns an adv info pointer that is only valid while hdev-lock is held. However,...

CVE-2026-74533: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs krefgetunlesszero hciconn::isodata is accessed and modified without lock or RCU. This leads to a race Task hdev-workqueue Task 2 isorecv isoconnputconn conn = LOAD hcon-isodata isoconnfreeconn...

CVE-2026-74509: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix advertising data UAFs hcifindadvinstance returns an advinfo pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in some...

PT-2026-72990

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where the iso connect ind function fails to acquire lock sock during the "ev3" phase. This leads to an unsafe access of iso pisk-conn,...

PT-2026-72993

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth ISO implementation. The problem occurs when detaching a connection from a host connection hcon, where failing to clear iso data while...

CVE-2026-74536: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release isosockkill tests !sockflagsk, SOCKZAPPED || sk-sksocket || sockflagsk, SOCKDEAD for early return, but this is always true since sockorphansk sets SOCKDEAD, so the sk reference...

CVE-2026-74541: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear isodata always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-isodata = NULL is necessary, otherwise later isoconnfree will UAF. Fix clearing of isodata in isosockdisconn Fixes...