PT-2026-70060

Name of the Vulnerable Software and Affected Versions Realtek BEE Bluetooth HCI driver affected versions not specified Description The bt hci bee send function in drivers/bluetooth/hci/hci bee.c violates the buffer-ownership contract of the bt hci driver api. The driver incorrectly releases the...

CVE-2026-68339

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

CVE-2026-68339

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

CVE-2026-68339 Bluetooth: btusb: validate Realtek vendor event length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

EUVD-2026-55440

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

CVE-2026-68339

The Linux kernel Bluetooth btusb vulnerability CVE-2026-68339 stems from btusb_recv_event_realtek() inspecting data[0] and data[2] before verifying the HCI event header and first parameter. This can cause misclassification of a vendor event as a coredump (e.g., a 2-byte event ff 00 with adjacent ...

EUVD-2026-55315

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832: fix use-after-free in rtl2832remove canceldelayedworksync is called before i2cmuxdeladapters in rtl2832remove. While the cancel waits for any running instance of i2cgatework to finish, it does not prevent the time...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2026-64506

A flaw was found in the Realtek 802.11ac wireless driver rtw89 within the Linux kernel. A remote attacker, within adjacent network range, could send specially crafted malformed Aggregated MAC Protocol Data Unit AMPDU frames. This incorrect handling of frames, particularly during rekey processes,...

CVE-2026-64536 staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in isapintkip IE loop The loop in isapintkip iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE-elementid and pIE-length are rea...

UBUNTU-CVE-2026-64444

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp IE loop The IE parsing loop in OnAssocRsp advances by pIE-length + 2 each iteration but only guards on i length from pframepktlen, which is one byte past the allocated receive buffer...

CVE-2026-64445 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...

EUVD-2026-48788

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp IE loop The IE parsing loop in OnAssocRsp advances by pIE-length + 2 each iteration but only guards on i length from pframepktlen, which is one byte past the allocated receive buffer...

CVE-2026-64442 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference pIE-length: - issueassocreq walks pmlmeinfo-network.ies to build the...

CVE-2026-64442

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference pIE-length: - issueassocreq walks pmlmeinfo-network.ies to build the...

PT-2026-64727

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence...

EUVD-2026-48657

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...

CVE-2026-64248 MIPS: smp: report dying CPU to RCU in stop_this_cpu()

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...

CVE-2026-63821

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...

USN-8492-5: Linux kernel (FIPS) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; -...