1548 matches found
CVE-2026-97408
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2caprecvframe currently reads that PSM unconditionally after validating only the outer L2CAP...
Linux Distros Unpatched Vulnerability : CVE-2026-97408
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2caprecvframe currently read...
PT-2026-105006
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap recv frame currently reads that PSM unconditionally after validating only the outer L2CAP...
PT-2026-98042
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth L2CAP implementation where the l2cap recv frame function reads the two-byte Protocol Service Multiplexer PSM at the start of the payload unconditionally...
CVE-2026-97408: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2caprecvframe currently reads that PSM unconditionally after validating only the outer L2CAP...
kernel: Bluetooth: L2CAP: Fix potential user-after-free
A use-after-free flaw was identified in the Linux kernel’s Bluetooth L2CAP implementation. In certain conditions, when allocating a socket buffer via allocskb, the kernel may release and later reacquire the channel lock; if the channel is disconnected in the meantime, a subsequent reference to th...
kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
A flaw was found in the Bluetooth L2CAP Logical Link Control and Adaptation Protocol component of the Linux kernel. When a device receives a connection response with an already-assigned destination Channel Identifier CID, the system may crash. This occurs because the kernel's procedure for...
kernel: Bluetooth: L2CAP: Fix potential user-after-free
A use-after-free flaw was identified in the Linux kernel’s Bluetooth L2CAP implementation. In certain conditions, when allocating a socket buffer via allocskb, the kernel may release and later reacquire the channel lock; if the channel is disconnected in the meantime, a subsequent reference to th...
kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
A flaw was found in the Bluetooth L2CAP Logical Link Control and Adaptation Protocol component of the Linux kernel. When a device receives a connection response with an already-assigned destination Channel Identifier CID, the system may crash. This occurs because the kernel's procedure for...
SUSE CVE-2026-90091
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...
SUSE CVE-2026-90092
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in l2capsockteardowncb and state set to BTCLOSED, as that can result to...
SUSE CVE-2026-90093
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan-conn safely in get/setsockopt Since commit b66774b48dd9 "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref" l2capchan::conn has held reference and remains non-NULL also after the...
SUSE CVE-2026-90256
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use protolock for l2capdata to fix l2capdisconnind hciconn::l2capdata is accessed without locks in l2capdisconnind via hciconntimeout discwork - hciprotodisconnind - l2capdisconnind. This is UAF if the l2capconn...
Linux Distros Unpatched Vulnerability : CVE-2026-90092
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in...
Linux Distros Unpatched Vulnerability : CVE-2026-90091
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent...
Linux Distros Unpatched Vulnerability : CVE-2026-90093
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: access chan-conn safely in get/setsockopt Since commit b66774b48dd9 Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref...
AZL-101909 CVE-2026-90256 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use protolock for l2capdata to fix l2capdisconnind hciconn::l2capdata is accessed without locks in l2capdisconnind via hciconntimeout discwork - hciprotodisconnind - l2capdisconnind. This is UAF if the l2capconn...
CVE-2026-90256
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use protolock for l2capdata to fix l2capdisconnind hciconn::l2capdata is accessed without locks in l2capdisconnind via hciconntimeout discwork - hciprotodisconnind - l2capdisconnind. This is UAF if the l2capconn...
AZL-102993 CVE-2026-90092 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in l2capsockteardowncb and state set to BTCLOSED, as that can result to...
DEBIAN-CVE-2026-90091
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...