1050545 matches found
SUSE CVE-2026-63945
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...
SUSE CVE-2026-63946
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...
CVE-2026-63945
A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream subsystem. A race condition exists where the isosockcleartimer function can access connection data without proper locking, while another function, isoconndel, concurrently modifies the same data. This can lead to a NULL point...
Linux Distros Unpatched Vulnerability : CVE-2026-64128
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT...
CVE-2026-63945
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...
CVE-2026-63946
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...
CVE-2026-64128 Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT branch of isorecv guards against a missing ISOSTART by checking...
EUVD-2026-45813
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT branch of isorecv guards against a missing ISOSTART by checking...
CVE-2026-64128 Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT branch of isorecv guards against a missing ISOSTART by checking...
CVE-2026-64128
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT branch of isorecv guards against a missing ISOSTART by checking...
CVE-2026-63871
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on isopi fields in hcigetroute calls isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync call hcigetroute using isopisk-dst, isopisk-src, and isopisk-srctype without holding locksock. Thes...
AZL-92570 CVE-2026-63871 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on isopi fields in hcigetroute calls isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync call hcigetroute using isopisk-dst, isopisk-src, and isopisk-srctype without holding locksock. Thes...
CVE-2026-63946
CVE-2026-63946: In the Linux kernel Bluetooth ISO path, iso_recv_frame can use a freed sk due to holding iso_conn_lock but releasing it before using conn->sk. The fix replaces a bare pointer read with iso_sock_hold(conn), which holds the sock while the spinlock is still held and atomically inc...
EUVD-2026-45719
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...
CVE-2026-63946
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...
CVE-2026-63946 Bluetooth: ISO: fix UAF in iso_recv_frame
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...
CVE-2026-63945 Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...
CVE-2026-63945
CVE-2026-63945 affects the Linux kernel Bluetooth ISO code. The vulnerability arises when iso_sock_clear_timer() reads iso_pi(sk)->conn twice without holding the socket lock, while iso_chan_del() may NULL the connection under lock_sock, creating a window where the reference can be dropped and ...
CVE-2026-63945 Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...
CVE-2026-63945
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...