CVE-2026-63975 Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2capecredconnrsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2capchandel may invalidate the tmp cursor...

EUVD-2026-45747

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close Since hcidevclosesync can now be called during the reset path, we should also set HCICMDDRAINWORKQUEUE. This avoids queuing timeouts while the hdev workqueue is bei...

CVE-2026-63974

CVE-2026-63974 affects the Linux kernel Bluetooth subsystem. The issue arises in hci_sync where HCI_CMD_DRAIN_WORKQUEUE must be set during device close because hci_dev_close_sync() can be invoked on a reset path, preventing timeouts from being queued while the hdev workqueue drains. The consequen...

CVE-2026-63974 Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close Since hcidevclosesync can now be called during the reset path, we should also set HCICMDDRAINWORKQUEUE. This avoids queuing timeouts while the hdev workqueue is bei...

CVE-2026-63974 Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close Since hcidevclosesync can now be called during the reset path, we should also set HCICMDDRAINWORKQUEUE. This avoids queuing timeouts while the hdev workqueue is bei...

CVE-2026-63974

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close Since hcidevclosesync can now be called during the reset path, we should also set HCICMDDRAINWORKQUEUE. This avoids queuing timeouts while the hdev workqueue is bei...

CVE-2026-63948

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work. The normal path in l2capchantimeout drops this reference with...

CVE-2026-63947 Bluetooth: HIDP: fix missing length checks in hidp_input_report()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

CVE-2026-63947

CVE-2026-63947 concerns the Linux kernel Bluetooth HIDP path. The vulnerability arises in hidp_input_report(), which reads keyboard/mouse payloads from an skb without first ensuring skb->len has enough data. The caller hidp_recv_intr_frame() fetches the 1-byte HIDP header before dispatching to...

EUVD-2026-45721

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work. The normal path in l2capchantimeout drops this reference with...

EUVD-2026-45720

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

CVE-2026-63948 Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work. The normal path in l2capchantimeout drops this reference with...

CVE-2026-63948

The CVE affects the Linux kernel Bluetooth L2CAP stack, where l2cap_chan_timeout() leaks a l2cap_chan reference when chan->conn is NULL because the early return skips l2cap_chan_put() after __set_chan_timer() holds the reference via l2cap_chan_hold(). The fix adds the missing l2cap_chan_put() ...

CVE-2026-63948 Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work. The normal path in l2capchantimeout drops this reference with...

CVE-2026-63947 Bluetooth: HIDP: fix missing length checks in hidp_input_report()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

CVE-2026-63947

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

EUVD-2026-45719

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...

CVE-2026-63946

CVE-2026-63946: In the Linux kernel Bluetooth ISO path, iso_recv_frame can use a freed sk due to holding iso_conn_lock but releasing it before using conn->sk. The fix replaces a bare pointer read with iso_sock_hold(conn), which holds the sock while the spinlock is still held and atomically inc...

CVE-2026-63946

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...

CVE-2026-63946 Bluetooth: ISO: fix UAF in iso_recv_frame

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...