kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP implementation. A remote Bluetooth Low Energy BLE device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list,...

PT-2026-89182

The Bluetooth Classic BR/EDR L2CAP receive handler bt l2cap br recv in subsys/bluetooth/host/classic/l2cap br.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BT L2CAP CONNECTED state. A dynamic channel is assigned i...

CVE-2026-15460: Operation on Resource in Wrong Phase of Lifetime

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

Linux Distros Unpatched Vulnerability : CVE-2026-80914

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, a...

RHEL 8 : kernel (RHSA-2026:65709)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65709 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth: hcievent: fix...

PT-2026-89084

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso conn ready iso conn ready looks up the BIS listener socket with iso get sock, which takes a reference, and then, without re-checking its state, creates a child socket...

CVE-2026-80914: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

RHEL 8 : kernel (RHSA-2026:65711)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65711 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth: hcievent: fix...

RHEL 9 : kernel (RHSA-2026:65712)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65712 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Kernel: Privilege escalation...

CVE-2026-45515

In a2dpvendoropusdecoderdecodepacket of a2dpvendoropusdecoder.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28627

In btmsecencryptchange of btmsec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28623

In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28606

In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-69889

Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69817

Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69448

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69398

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69388

Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

CVE-2026-68849

Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacker to disclose information locally...

EUVD-2026-73997

In a2dpvendoropusdecoderdecodepacket of a2dpvendoropusdecoder.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...