CVE-2026-80819 Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

EUVD-2026-71254

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

CVE-2026-80819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

CVE-2026-80819

CVE-2026-80819 is a null pointer dereference in the Linux kernel 's Bluetooth RFCOMM subsystem. The flaw occurs when rfcomm_sock_recvmsg() calls rfcomm_dlc_accept() without holding rfcomm_mutex. A remote peer can trigger the bug by sending a DISC frame on a deferred-setup DLC, which clears d->...

EUVD-2026-71407

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80764

CVE-2026-80764 affects the Linux kernel Bluetooth subsystem. The vulnerability is a use-after-free (UAF) in the HCI event handler: hci_cc_reset() clears the LE accept and resolving lists without acquiring hdev->lock , while debugfs readers (e.g., white_list_show) hold that lock while traversin...

CVE-2026-80764 Bluetooth: hci_event: fix LE list UAF on reset

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80764 Bluetooth: hci_event: fix LE list UAF on reset

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80764

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80763 Bluetooth: hci_event: validate LE Set CIG Parameters response

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

EUVD-2026-71406

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

CVE-2026-80763 Bluetooth: hci_event: validate LE Set CIG Parameters response

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

CVE-2026-80763

CVE-2026-80763 is an out-of-bounds read in the Linux kernel Bluetooth HCI subsystem. In hci_cc_le_set_cig_params(), the handler trusts the num_handles field of the LE Set CIG Parameters Command Complete response and reads the trailing handle array without verifying that the remaining skb data act...

CVE-2026-80763

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

EUVD-2026-71405

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...

CVE-2026-80762 Bluetooth: hci_sync: Fix accept list UAF during suspend

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...

CVE-2026-80762 Bluetooth: hci_sync: Fix accept list UAF during suspend

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...

CVE-2026-80762

CVE-2026-80762 is a use-after-free in the Linux kernel Bluetooth HCI subsystem (hci_sync). The function hci_update_event_filter_sync() walks the device's accept list while issuing synchronous HCI commands per remote-wakeup device. The suspend path holds hdev->req_lock, but accept-list mutation...

CVE-2026-80762

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...

CVE-2026-80761

CVE-2026-80761 is a kernel information disclosure in the Linux kernel's Bluetooth ISO (Isochronous) socket subsystem. The function iso_sock_getname() populates a struct sockaddr_iso without first clearing it, causing uninitialized kernel stack bytes to be copied to user space via getsockname(2) o...