CVE-2026-72336: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before reading hcon-l2capdata and before lowpancontrolwrite later dereferences...

Linux Distros Unpatched Vulnerability : CVE-2026-74540

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: fix UAF in l2capleconnectrsp l2capleconnectrsp obtains a channel via l2capgetchanbyident but neither holds a reference nor uses...

CVE-2026-74540: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2capleconnectrsp l2capleconnectrsp obtains a channel via l2capgetchanbyident but neither holds a reference nor uses l2capchanholdunlesszero before locking and operating on it. A concurrent l2capchand...

PT-2026-72992

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth L2CAP implementation. The function l2cap le connect rsp retrieves a channel using l2cap get chan by ident but fails to hold a reference or...

Linux Distros Unpatched Vulnerability : CVE-2026-72333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee Bluetooth: L2CAP: Fix not tracking outstanding TX ident changed ident...

K000162910: Linux kernel vulnerability CVE-2026-53208

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/bluetooth/l2capcore.c:l2capsigchannel accepts BR/EDR signaling packets up to the channel MTU and dispatches each command without...

ROS-20260806-73-0010

The vulnerability of the l2capsockcleanuplisten function in the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

ROS-20260806-73-0025

The vulnerability of the l2capconnect function in the net/bluetooth/l2capcore.c module of the Linux kernel is related to insufficiently secure data encryption. Exploiting this vulnerability could allow a remote attacker to disclose sensitive information that is protected by this function...

PT-2026-67714

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A use-after-free issue exists in the Bluetooth host ATT layer within the subsys/bluetooth/host/att.c file. The system associates in-flight ATT TX buffers with...

Linux kernel Bluetooth L2CAP Buffer Overflow DoS

The vulnerability of the functions l2capregisteruser and l2capunregisteruser in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow a attacker to cause service...

CVE-2026-64434

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. An asynchronous operation in the l2capchantimeout function can attempt to access a connection that has already been deallocated. This use-after-free vulnerability could allow a local...

AZL-94143 CVE-2026-64557 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...

CVE-2026-64557

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...

CVE-2026-64557

Summary: CVE-2026-64557 affects the Linux kernel Bluetooth L2CAP implementation, causing a use-after-free during new Bluetooth connections. The bug occurs when l2cap_sock_new_connection_cb() returns the new channel after release_sock(parent); once the parent lock is dropped, the enqueued child so...

CVE-2026-64557: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...

(Pwn2Own) Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific...

(Pwn2Own) Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exis...

MiracleLinux 8 : kernel-4.18.0-553.146.1.el8_10 (AXSA:2026-1384:55)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1384:55 advisory. kernel: RDMA/mana: Remove user triggerable WARNON in manaibcreateqprss CVE-2026-46117 kernel: Bluetooth: l2cap: Add missing chan lock in...

SUSE CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

AZL-93545 CVE-2026-64434 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...