ROS-20260821-73-0031

The vulnerability of the Linux kernel Bluetooth HCI driver implementation relates to competitive access to resources during the execution of the sniffmin,maxintervalset function in the net/bluetooth/hcidebugfs.c module. Exploiting this vulnerability allows a remote attacker to compromise the...

CVE-2026-11893

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

CVE-2026-11894

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11894 Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11893

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

CVE-2026-11894: Double Free

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

USN-5299-1: Linux kernel vulnerabilities

Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation could reassemble mixed encrypted and plaintext fragments. A physically proximate attacker could possibly use this issue to inject packets or exfiltrate selected fragments. CVE-2020-26147 It was discovered that the bluetooth...

USN-5016-1 linux, linux-aws, linux-aws-5.8, linux-azure, linux-azure-5.8, linux-gcp, linux-gcp-5.8, linux-hwe-5.8, linux-kvm, linux-oracle, linux-oracle-5.8, linux-raspi vulnerabilities

It was discovered that the virtual file system implementation in the Linux kernel contained an unsigned to signed integer conversion error. A local attacker could use this to cause a denial of service system crash or execute arbitrary code. CVE-2021-33909 Or Cohen and Nadav Markus discovered a...