6 matches found
CVE-2026-19738
The Bluetooth Link Layer Control Procedure LLCP implementation for Connected Isochronous Stream CIS creation retains an RX node ctx-noderef.rx, marked NODERXTYPERETAIN so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LLCISREQ, and on the...
CVE-2026-19738 Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures
The Bluetooth Link Layer Control Procedure LLCP implementation for Connected Isochronous Stream CIS creation retains an RX node ctx-noderef.rx, marked NODERXTYPERETAIN so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LLCISREQ, and on the...
CVE-2026-19738 Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures
The Bluetooth Link Layer Control Procedure LLCP implementation for Connected Isochronous Stream CIS creation retains an RX node ctx-noderef.rx, marked NODERXTYPERETAIN so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LLCISREQ, and on the...
CVE-2026-19738 Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures
The Bluetooth Link Layer Control Procedure LLCP implementation for Connected Isochronous Stream CIS creation retains an RX node ctx-noderef.rx, marked NODERXTYPERETAIN so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LLCISREQ, and on the...
PT-2026-110225
The Bluetooth Link Layer Control Procedure LLCP implementation for Connected Isochronous Stream CIS creation retains an RX node ctx-node ref.rx, marked NODE RX TYPE RETAIN so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LL CIS REQ, and ...
CVE-2026-63944 Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: fix UAF in hcilecreatecissync hcilecreatecissync dereferences conn-conntimeout after releasing both rcureadlock and hcidevlockhdev. The conn pointer was obtained from an RCU-protected iteration over...