Linux Distros Unpatched Vulnerability : CVE-2026-97975

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device i...

CVE-2026-98110

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

CVE-2026-98108

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...

Linux Distros Unpatched Vulnerability : CVE-2026-98110

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If th...

Ubuntu 24.04 LTS : Linux kernel (Azure CVM) vulnerabilities (USN-8793-1)

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8793-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

Linux Distros Unpatched Vulnerability : CVE-2026-98107

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED...

Linux Distros Unpatched Vulnerability : CVE-2026-97976

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintelpcie: validate packetlen before skbputdata btintelpciesubmitrxwork reads packetlen from rfhhdr without checking if it exceeds the RX buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-93209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcicore: use skbget instead of skbclone for reqskb BT enable fails intermittently with -ETIMEDOUT -110. The kernel log shows the HCI Read Local Versi...

Linux Distros Unpatched Vulnerability : CVE-2026-98109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing...

PT-2026-98770

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth L2CAP implementation where l2cap le connect req fails to correctly set the channel mode, leaving it at the default value set by l2cap new connection. Thi...

PT-2026-98772

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth btintel component where the firmware ID is treated as a NUL-terminated string despite the TLV Type-Length-Value length being its only boundary. If the...

PT-2026-98773

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the btintel parse version tlv function fails to ensure that the value length is sufficient for the specific Type-Length-Value TLV type...

PT-2026-98639

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Bluetooth subsystem between hci conn del sysfs and concurrent child device unregistration, such as when bnep session calls unregister netdev. This occurs...

PT-2026-98641

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth btusb module. The functions btusb close and btusb flush use the asynchronous cancel delayed work to cancel data-rx work. If btusb rx wo...

CVE-2026-97908: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...

SUSE CVE-2026-93209

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: use skbget instead of skbclone for reqskb BT enable fails intermittently with -ETIMEDOUT -110. The kernel log shows the HCI Read Local Version command was sent and the firmware replied with status 0x00 logged ...

SUSE CVE-2026-93247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...

SUSE CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

CVE-2026-84403

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device...

CVE-2026-84403 Botslab G980H Dashcams Missing Authentication for Critical Function

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device...