Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hciqca: Fixed the driver shutdown when the serdev is closed. The driver shutdown callback which sends EDLSOCRESET to the device via serdev should not be invoked when the HCI device is not open e.g., if hcidevopensyn...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: qca – fixed an issue where information was leaked when retrieving the board ID. A missing sanity check was added when retrieving the board ID to prevent the leakage of slab data when later requesting the firmware...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: qca – added missing firmware sanity checks. Added missing sanity checks when parsing the firmware files before downloading them. This prevents access to and corruption of memory beyond the vmalloced buffer...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-002625)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002625 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot Commit 272970be3dab...

PT-2026-72740

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci qca: fix NULL pointer dereference in qca setup for non-serdev device hu-serdev is NULL for hci uart attached via non-serdev paths, but qca setup unconditionally calls serdev device get drvdatahu-serdev and...

PT-2026-72739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci qca: fix NULL pointer dereference in qca dmp hdr for non-serdev device hu-serdev is NULL for hci uart attached via non-serdev paths, but qca dmp hdr unconditionally dereferences hu-serdev-dev.driver-name, causing a...

SUSE CVE-2026-68389

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Clear memdump state on invalid dump size qcacontrollermemdump allocates qca-qcamemdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active,...

CVE-2026-68389

A flaw was found in the Bluetooth Host Controller Interface HCI Qualcomm Atheros QCA driver within the Linux kernel. This vulnerability occurs when the controller reports an invalid zero memory dump size, leading to improper state cleanup. An attacker could potentially exploit this to cause memor...

CVE-2026-68389 Bluetooth: hci_qca: Clear memdump state on invalid dump size

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Clear memdump state on invalid dump size qcacontrollermemdump allocates qca-qcamemdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active,...

CVE-2026-68389

The CVE-2026-68389 entry concerns a Linux kernel Bluetooth HCI driver (Qualcomm/Atheros QCA) issue. A zero/invalid memdump size in qca_controller_memdump() could leave qca->qca_memdump and collection flags in an inconsistent state, causing a later memdump work item to operate on freed memory a...

Bluetooth: qca: fix NVM tag length underflow in TLV parser

...

CVE-2026-64573

A flaw was found in the Linux kernel's Bluetooth subsystem, specifically within the qca driver. A local attacker could exploit an integer underflow vulnerability in the NVM tag length parser by providing specially crafted firmware data. This could lead to an out-of-bounds memory write, potentiall...

CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

AZL-94470 CVE-2026-64573 affecting package kernel for versions less than 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

UBUNTU-CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573 Bluetooth: qca: fix NVM tag length underflow in TLV parser

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573 Bluetooth: qca: fix NVM tag length underflow in TLV parser

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573

The CVE-2026-64573 issue affects the Linux kernel Bluetooth stack (qca TLV parser). In the TLV_TYPE_NVM branch of qca_tlv_check_data(), the loop bound used length - sizeof(struct tlv_type_nvm) with length as a signed int promoted to size_t, which could underflow when firmware

Linux Distros Unpatched Vulnerability : CVE-2026-64573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is while idx length - sizeofstruct...