CVE-2026-15460 Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-15460

CVE-2026-15460 affects Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP, specifically the receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c. The handler dispatched inbound data PDUs based solely on the destination channel ID without verifying the channel had reached BT_L2...

DEBIAN-CVE-2026-80914

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

AZL-99959 CVE-2026-80914 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

CVE-2026-80914

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

CVE-2026-80914 Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

CVE-2026-80914

CVE-2026-80914 is a use-after-free vulnerability in the Linux kernel's Bluetooth ISO subsystem , specifically in the iso_conn_ready() function. When a BIS listener socket is closed concurrently between iso_get_sock() and lock_sock(), the socket may be freed while a child socket remains linked to ...

CVE-2026-80914 Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

EUVD-2026-75088

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syst...

kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP implementation. A remote Bluetooth Low Energy BLE device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list,...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP implementation. A remote Bluetooth Low Energy BLE device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list,...

PT-2026-89182

The Bluetooth Classic BR/EDR L2CAP receive handler bt l2cap br recv in subsys/bluetooth/host/classic/l2cap br.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BT L2CAP CONNECTED state. A dynamic channel is assigned i...

CVE-2026-15460: Operation on Resource in Wrong Phase of Lifetime

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

Linux Distros Unpatched Vulnerability : CVE-2026-80914

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, a...

PT-2026-89084

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso conn ready iso conn ready looks up the BIS listener socket with iso get sock, which takes a reference, and then, without re-checking its state, creates a child socket...