SUSE CVE-2026-64557

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...

CVE-2026-64408

A flaw was found in the Bluetooth Network Encapsulation Protocol BNEP module of the Linux kernel. The bnepaddconnection function reads the Logical Link Control and Adaptation Protocol L2CAP connection without properly holding a channel lock. This can allow a local attacker to trigger a...

CVE-2026-64557

A flaw was found in the Linux kernel's Bluetooth L2CAP component. A race condition exists during the handling of new Bluetooth connections, where a newly created socket can be prematurely freed by another process before a callback function completes its operation. This use-after-free vulnerabilit...

CVE-2026-64403

A flaw was found in the Bluetooth L2CAP Logical Link Control and Adaptation Protocol component of the Linux kernel. The l2capgetconfopt function, responsible for processing configuration options, does not properly validate the length of an option before attempting to read its value. This allows a...

CVE-2026-64557 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...

PT-2026-65735

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap sock new connection cb l2cap sock new connection cb returned l2cap pisk-chan after release sockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable...

SUSE CVE-2026-64403

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

UBUNTU-CVE-2026-64403

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

UBUNTU-CVE-2026-64408

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its HCI device to registernetdev. Controller teardown can clear and relea...

CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64408 Bluetooth: bnep: pin L2CAP connection during netdev registration

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its HCI device to registernetdev. Controller teardown can clear and relea...

EUVD-2026-48947

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

CVE-2026-64403

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

PT-2026-64626

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: Fix null ptr deref in hci abort conn hci abort conn read hci skb eventhdev-sent cmd when a connection was pending, but hdev-sent cmd can be NULL while req status is still HCI REQ PEND, leading to a NULL point...

PT-2026-64624

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth L2CAP implementation where the l2cap get conf opt function reads the opt-len field, which is controlled by an attacker, and dereferences opt-val before...

RLSA-2026:42552 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: RDMA/mana: Remove user triggerable WARNON in manaibcreateqprss CVE-2026-46117 kernel: Bluetooth: l2cap: Add missing chan lock in l2capecredreconfrsp CVE-2026-53071 Bug Fixes and...

ALSA-2026:43307 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: scsi: core: Wake up the error handler when final completions race against each other CVE-2026-23110...

CVE-2026-63948

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP component. A reference leak occurs in the l2capchantimeout function. When a channel's connection is null, an early exit path in the function fails to release a held channel reference. This oversigh...

CVE-2026-63976

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol implementation. A remote attacker, acting as a peer, could exploit a vulnerability where the system fails to clear a channel identifier after a successful Enhanced Credit Based Mode ECRED...

SUSE CVE-2026-63947

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...