Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: btusb: mediatek – Fixed a kernel crash that occurred when releasing the mtk iso interface. When performing reset tests and encountering abnormal card drop issues that lead to a kernel crash, it is necessary to perfo...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: Fixed possible UAFs This attempt to fix possible UAFs is due to the fact that the struct mgmtpending is freed while it is still being processed, as seen in the following trace. To address this issue,...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciuart: fixed a NULL pointer dereferencing in hciuartwritework The hciuartsetproto function sets HCIUARTPROTOINIT before calling hciuartregisterdev. This function calls proto-open to initialize hu-priv. However, if a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bcsp: receives data only if registered Currently, the bcsprecv function can still be called even when the BCSP protocol has not been registered. This leads to a NULL pointer dereference, as shown in the following stack...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcisync: fixed a race condition in hcicmdsyncdequeueonce. The function hcicmdsyncdequeueonce performs a lookup and then cancels the entry under two separate lock sections. Meanwhile, hcicmdsyncwork can also delete t...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: SCO: Fixed UAF in scoconnfree BUG: KASAN: Slab-use-after-free in scoconnfree, net/bluetooth/sco.c:87 inline BUG: KASAN: Slab-use-after-free in krefput, include/linux/kref.h:65 inline BUG: Slab-use-after-free in...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: Cancel the mesh send timer when the hdev is removed The meshsenddone timer is not canceled when the hdev is removed, which can cause a crash if the timer triggers after the hdev is gone. Cancel the timer when...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: Prevent race conditions in socket write iteration and sock bind. There is a potential race condition between sock bind and socket write iteration. bind may free the same memory block via mgmtpending before the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcisync: Fixed a double-free in ‘hcidiscoveryfilterclear’. The function ‘hcidiscoveryfilterclear’ frees the ‘uuids’ array and then sets it to NULL. There is a small chance that the following races will occur:...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Avoid NULL dereference of btusbmtkclaimisointf In the btusbmtksetup function, we set btmtkdata-isopktintf to: usbifnumtoifdata-udev, MTKISOIFNUM This function may return NULL in some cases. Even when...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: In btusb, there is an issue where the cleanup operations during btusbdisconnect are not performed in the correct order, leading to a Use-After-Free UAF condition. There is also a KASAN issue in btusbdisconnect: A re...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fixed out-of-band OOB access during the parseadvmonitorpattern function execution. In the parseadvmonitorpattern function, the value of the length variable is currently limited to HCIMAXEXTADLENGTH251. The size o...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Check the length of skb for an unknown CC opcode. In hcicmdCompleteevt, if the command completion event has an unknown opcode, we assume that the first byte of skb-data contains the return status. However, th...

The vulnerability of the smp_cmdPairingReq() function in the net/bluetooth/smp.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the smpcmdPairingReq function in the net/bluetooth/smp.c module of the Linux operating system is related to insufficient security checks for protected connections. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

Linux Distros Unpatched Vulnerability : CVE-2026-68189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to...

Linux Distros Unpatched Vulnerability : CVE-2026-68188

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: Fix session UAF in settermios rfcommttysettermios tests dlc-session without rfcommmutex and later passes the pointer to rfcommsendrpn. The...

Linux Distros Unpatched Vulnerability : CVE-2026-68393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may...

Linux Distros Unpatched Vulnerability : CVE-2026-68085

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciuart: clear HCIUARTSENDING when writework is canceled HCIUARTSENDING bit in txstate means writework is pending and blocks queueing it again...

Linux Distros Unpatched Vulnerability : CVE-2026-68391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Us...

CVE-2026-11742

The kernel queue helper zqueuenodepeek in kernel/queue.c dereferences a node taken from a queue's dataq list, reading the node's flag byte and, for items enqueued via kqueueallocappend/allocprepend, the data pointer of an internally allocated allocnode struct. The implementations of...