PT-2026-97876

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where Bluetooth enablement fails intermittently with a timeout error. The problem occurs because the hci send cmd sync function uses skb clone ...

PT-2026-97934

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the Bluetooth management component. The uuid count member of the discovery state structure is accessed and modified without proper locking, creating ...

Linux Distros Unpatched Vulnerability : CVE-2026-93247

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is ...

PT-2026-105006

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap recv frame currently reads that PSM unconditionally after validating only the outer L2CAP...

kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A race condition in the rfcommttysettermios function allows a session to be freed while it is still actively in use. This use-after-free UAF vulnerability can be exploited by a local attacker. Successful exploitation leads to a...

kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

A flaw was found in the Linux kernel's Bluetooth management component. This vulnerability involves a Use-After-Free UAF condition, a type of memory corruption where the system attempts to use memory after it has been freed. This can occur due to improper handling of hciconn pointers, potentially...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

SUSE CVE-2026-95326

Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-95348

Use after free in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-96456

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456

The Reachy Mini robot's Bluetooth service contains a vulnerability where it fails to validate the specific caller of a Bluetooth command. The WriteValue function in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores the device identity passed by BlueZ , instead relying on ...

EUVD-2026-85186

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

A flaw was found in the Linux kernel's Bluetooth management component. This vulnerability involves a Use-After-Free UAF condition, a type of memory corruption where the system attempts to use memory after it has been freed. This can occur due to improper handling of hciconn pointers, potentially...

kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A race condition in the rfcommttysettermios function allows a session to be freed while it is still actively in use. This use-after-free UAF vulnerability can be exploited by a local attacker. Successful exploitation leads to a...

Linux Distros Unpatched Vulnerability : CVE-2026-95348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute...

Linux Distros Unpatched Vulnerability : CVE-2026-95326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access...

ALSA-2026:70498 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - Disallow concurrent writes in afalgsendmsg CVE-2025-39964 kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry CVE-2026-45894 kernel: crypto: ccp - Fix a...