EUVD-2026-103821

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Lock parent access during enhanced SCO setup Bluetooth: hciconn: Lock parent access during enhanced SCO setup hcienhancedsetupsync runs on the request workqueue without the hcidevlock held by its caller when...

CVE-2026-98736 Bluetooth: hci_conn: Lock parent access during enhanced SCO setup

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Lock parent access during enhanced SCO setup Bluetooth: hciconn: Lock parent access during enhanced SCO setup hcienhancedsetupsync runs on the request workqueue without the hcidevlock held by its caller when...

CVE-2026-98737 Bluetooth: hci_sync: Fix inquiry cache use-after-free

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix inquiry cache use-after-free The sync command worker holds hdev-reqlock, but inquiry-cache updates and flushes use hdev-lock. Both hciaclcreateconnsync and hcistopdiscoverysync look up entries and read the...

CVE-2026-98736

The Linux kernel contains a use-after-free vulnerability in the Bluetooth subsystem during enhanced SCO setup . The issue occurs because hci_enhanced_setup_sync() runs on the request workqueue without holding the hci_dev_lock . This allows the receive workqueue to unlink and release the ACL paren...

EUVD-2026-103822

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix inquiry cache use-after-free The sync command worker holds hdev-reqlock, but inquiry-cache updates and flushes use hdev-lock. Both hciaclcreateconnsync and hcistopdiscoverysync look up entries and read the...

CVE-2026-98737

A use-after-free vulnerability exists in the Linux kernel Bluetooth subsystem within hci_sync . The issue stems from a race condition where the sync command worker holds hdev->req_lock, while inquiry-cache updates and flushes utilize hdev->lock. Specifically, functions hci_acl_create_conn_s...

CVE-2026-98736 Bluetooth: hci_conn: Lock parent access during enhanced SCO setup

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Lock parent access during enhanced SCO setup Bluetooth: hciconn: Lock parent access during enhanced SCO setup hcienhancedsetupsync runs on the request workqueue without the hcidevlock held by its caller when...

CVE-2026-98737 Bluetooth: hci_sync: Fix inquiry cache use-after-free

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix inquiry cache use-after-free The sync command worker holds hdev-reqlock, but inquiry-cache updates and flushes use hdev-lock. Both hciaclcreateconnsync and hcistopdiscoverysync look up entries and read the...

CVE-2026-98735

A use-after-free vulnerability exists in the Linux kernel Bluetooth hci_core component. The issue occurs because hci_chan_sent() selects a channel under RCU but releases the read lock before accessing chan->conn. This allows a disconnect command timeout to trigger hci_chan_del(), which unlinks...

CVE-2026-98735 Bluetooth: hci_core: Serialize ACL scheduling with channel deletion

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize ACL scheduling with channel deletion hcichansent selects a channel under RCU but drops the read lock before accessing chan-conn and returning the channel. The ACL and LE schedulers then use its packe...

CVE-2026-98735 Bluetooth: hci_core: Serialize ACL scheduling with channel deletion

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize ACL scheduling with channel deletion hcichansent selects a channel under RCU but drops the read lock before accessing chan-conn and returning the channel. The ACL and LE schedulers then use its packe...

EUVD-2026-103820

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize ACL scheduling with channel deletion hcichansent selects a channel under RCU but drops the read lock before accessing chan-conn and returning the channel. The ACL and LE schedulers then use its packe...

CVE-2026-98734 Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize SCO and ISO scheduling with teardown hcilowsent selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used...

EUVD-2026-103819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize SCO and ISO scheduling with teardown hcilowsent selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used...

CVE-2026-98734

The Linux kernel contains a use-after-free vulnerability in the hci_core component. The issue arises because hci_low_sent() drops the RCU read lock before calculating the connection quota, allowing hci_abort_conn_sync() to remove and free the connection while it is still being accessed by hci_sch...

CVE-2026-98734 Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize SCO and ISO scheduling with teardown hcilowsent selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used...

CVE-2026-98733

The Linux kernel contains a vulnerability in the Bluetooth subsystem within the hci_core component. The hci_queue_iso() function incorrectly calls __skb_queue_tail() without holding the conn->data_q.lock, leading to a race condition where a transmit worker can concurrently remove packets using...

CVE-2026-98733 Bluetooth: hci_core: Serialize fragmented ISO packet queueing

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize fragmented ISO packet queueing The fragmented path in hciqueueiso calls skbqueuetail without holding conn-dataq.lock. The socket lock serializes senders, but the transmit worker can concurrently remo...

CVE-2026-98733 Bluetooth: hci_core: Serialize fragmented ISO packet queueing

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize fragmented ISO packet queueing The fragmented path in hciqueueiso calls skbqueuetail without holding conn-dataq.lock. The socket lock serializes senders, but the transmit worker can concurrently remo...

EUVD-2026-103818

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize fragmented ISO packet queueing The fragmented path in hciqueueiso calls skbqueuetail without holding conn-dataq.lock. The socket lock serializes senders, but the transmit worker can concurrently remo...