KB5120242: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (August 2026)

The remote Windows host is missing security update 5120242 or hotpatch 5120229. It is, therefore, affected by multiple vulnerabilities - Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. CVE-2026-62815 - Stack-based buffer overflow in Windows DNS...

PT-2026-70058

Name of the Vulnerable Software and Affected Versions Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x affected versions not specified Description The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers contains an issue where the bt bflb send function in drivers/bluetooth/hci/hci...

Security Bulletin: Vulnerability in tritonclient bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the tritonclient library, which is affected by a denial of service vulnerability. CVE-2025-33202. Vulnerability Details CVEID:CVE-2025-33202 DESCRIPTION: NVIDIA Triton Inference Server for Linux and Windows contains ...

CVE-2026-68392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...

CVE-2026-68393

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

CVE-2026-68394

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

CVE-2026-68390

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold hdev-lock for hciconnparams lookups hciconnparamslookup requires hdev-lock be held, otherwise the list iteration or param access is not safe. Hold hdev-lock for params lookups in hcisync...

CVE-2026-68339

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

CVE-2026-68189

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68085

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciuart: clear HCIUARTSENDING when writework is canceled HCIUARTSENDING bit in txstate means writework is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hciuartclose,...

EUVD-2026-55580

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

CVE-2026-68394

In CVE-2026-68394, the Linux kernel Bluetooth MGMT path had a use-after-free in conn_update_sync triggered by MGMT_OP_LOAD_CONN_PARAM queuing a param update. The queued work incorrectly kept a borrowed hci_conn_params pointer; if userspace freed the entry before the callback ran, a use-after-free...

EUVD-2026-55579

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

CVE-2026-68393

The CVE-2026-68393 entry concerns the Linux kernel Bluetooth hci_sync component. The root cause is the use of RCU-protected pointers outside their critical sections without proper reference counting, which could lead to a Use-After-Free (UAF). The fix extends the critical section to cover both th...

EUVD-2026-55578

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...

CVE-2026-68392

Summary: CVE-2026-68392 affects the Linux kernel Bluetooth management path. The vulnerability arises from dereferencing RCU-protected pointers outside critical sections during unpair_device/disconnect_sync, enabling a Use-After-Free (UAF) scenario. The fix targets the critical section handling fo...

CVE-2026-68391

CVE-2026-68391 affects the Linux kernel Bluetooth management path, specifically the mgmt_pending_cmds handling of hci_conn references. The issue is a Use-After-Free risk from dereferencing RCU-protected pointers outside critical sections and from using hci_conn in hci_sync callbacks without holdi...

CVE-2026-68391 Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

CVE-2026-68389

The CVE-2026-68389 entry concerns a Linux kernel Bluetooth HCI driver (Qualcomm/Atheros QCA) issue. A zero/invalid memdump size in qca_controller_memdump() could leave qca->qca_memdump and collection flags in an inconsistent state, causing a later memdump work item to operate on freed memory a...

EUVD-2026-55440

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...