CVE-2026-80692

CVE-2026-80692 is a theoretical Use-After-Free (UAF) in the Linux kernel's Bluetooth HCI subsystem , specifically in the hci_connect_acl() and hci_connect_le_sync() callbacks. If the conn object is freed while the hci_sync task is running, a UAF can occur. The fix holds a refcount to the conn obj...

CVE-2026-80692 Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

PT-2026-82992

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF condition exists in the Bluetooth component. This occurs when the conn object is freed while the hci sync task is still running. The issue is specifically related to...

SUSE CVE-2026-74300

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcisync: Fixed UAFs related to advertising data. The hcifindadvinstance function returns a advinfo pointer that is only valid while hdev-lock is held. In the advertising command-sync path, instance lookups are...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hci: validate codec capability element length The hcireadcodeccapabilities function returns a sequence of capability elements. Each element begins with a one-byte length, followed by that many payload bytes...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-6.1, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fixed handling of HCIEVIOCAPAREQUEST. If we receive HCIEVIOCAPAREQUEST while HCIOPREADREMOTEEXTFEATURES has not yet been responded to, assume that the remote supports SSP. Otherwise, this event should not be...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Use RCU for hciconnparams and iterate safely in hcisync. hciupdateacceptlistsync iterates over hdev-pendleconns and hdev-pendlereports, and waits for controller events within the loop body, without holding the hdev...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: holding the connection during the hcipastsync callback. This issue avoids handing over freed pointers to hciconnvalid, which might have been reused by kmalloc...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: holding the connection during the hciconnectpasync callback There is a theoretical use-after-free vulnerability if the connection is freed while the hcisync task is running. Holding the reference count prevent...

ROS-20260821-73-0031

The vulnerability of the Linux kernel Bluetooth HCI driver implementation relates to competitive access to resources during the execution of the sniffmin,maxintervalset function in the net/bluetooth/hcidebugfs.c module. Exploiting this vulnerability allows a remote attacker to compromise the...

CVE-2026-74300

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI component. A malicious Bluetooth controller could send a specially crafted response during the 'Read Local Codec Capabilities' operation. Insufficient validation of the codec capability element length could allow the...

CVE-2026-74529

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI synchronization component. This vulnerability, a Use-After-Free UAF, occurs when a connection object is prematurely released while the hcisync task is still active. A local attacker could potentially exploit this to...

AZL-96246 CVE-2026-74509 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix advertising data UAFs hcifindadvinstance returns an advinfo pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in some...

CVE-2026-74531

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-74300

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes...

UBUNTU-CVE-2026-74300

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes...

CVE-2026-74300

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes...

CVE-2026-74302 Bluetooth: hci_core: Fix UAF in hci_unregister_dev()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory...

CVE-2026-74300 Bluetooth: hci: validate codec capability element length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes...