PT-2026-72960

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidp recv ctrl frame and hidp recv intr frame read skb-data0 before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty...

PT-2026-72961

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix advertising data UAFs hci find adv instance returns an adv info pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in so...

PT-2026-72985

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref get unless zero hci conn::iso data is accessed and modified without lock or RCU. This leads to a race Task hdev-workqueue Task 2 iso recv iso conn putconn conn = LOAD hcon-iso data iso co...

PT-2026-72982

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci connect big sync callback There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the...

PT-2026-72959

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidp get raw report waits for a numbered report, hidp process data compares the expected report number with skb-data0. A connected HIDP peer can reply with only a DATA...

PT-2026-72738

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Fix UAF in hci unregister dev hci unregister dev does not disable cmd timer and ncmd timer before the hci dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed...

PT-2026-72522

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO END/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISO CONT, ISO END packets. We currently reject them if they are last. If controller sends malformed sequence ISO...

PT-2026-72736

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci read codec...

Linux Distros Unpatched Vulnerability : CVE-2026-74302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fire...

PT-2026-72523

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci add adv monitor publishes a new adv monitor in hdev-adv monitors idr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

Linux Distros Unpatched Vulnerability : CVE-2026-74531

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid...

Linux Distros Unpatched Vulnerability : CVE-2026-74541

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: clear isodata always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-isodata = NULL is necessary, otherwise later...

Linux Distros Unpatched Vulnerability : CVE-2026-74539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release. CVE-2026-74539 Note...

Linux Distros Unpatched Vulnerability : CVE-2026-74507

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: HIDP: validate numbered report payloads When hidpgetrawreport waits for a numbered report, hidpprocessdata compares the expected report number with...

Linux Distros Unpatched Vulnerability : CVE-2026-74540

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: fix UAF in l2capleconnectrsp l2capleconnectrsp obtains a channel via l2capgetchanbyident but neither holds a reference nor uses...

Linux Distros Unpatched Vulnerability : CVE-2026-74528

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...

Linux Distros Unpatched Vulnerability : CVE-2026-74509

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: Fix advertising data UAFs hcifindadvinstance returns an advinfo pointer that is valid only while hdev-lock is held. The advertising...

CVE-2026-18164

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

EUVD-2026-58274

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

CVE-2026-18164

The CVE concerns Flow Neuroscience FL-100 with an undocumented hard-coded credential that bypasses authentication. The credential is shared across all device units, allowing an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state. Affected component is ...