CVE-2026-80683 Bluetooth: SCO: give the socket its own sco_conn reference

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

CVE-2026-80683

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

CVE-2026-80666

CVE-2026-80666 affects the Linux kernel Bluetooth SCO (synchronous connection-oriented) socket implementation in net/bluetooth/sco.c. The root cause is a race condition between sco_sock_close() and the asynchronous sco_sock_timeout() work item: both attempt to hold lock_sock(sk) simultaneously, r...

CVE-2026-80666 Bluetooth: sco: Fix a race condition in sco_sock_timeout()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

CVE-2026-80666 Bluetooth: sco: Fix a race condition in sco_sock_timeout()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

EUVD-2026-67542

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

CVE-2026-80666

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

SUSE CVE-2026-72333

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee "Bluetooth: L2CAP: Fix not tracking outstanding TX ident" changed ident allocation to use an IDA, releasing idents in l2capputident when the...

EUVD-2026-67297

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may b...

CVE-2026-5706

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may b...

CVE-2026-80666: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously and locksocksk. If the socket is closing while the timer is running, it holds the same lock locksocksk twice, leading to a deadlock. CPU 0...

CVE-2026-5706: Improper Handling of Length Parameter Inconsistency

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may b...

PT-2026-82983

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth SCO Synchronous Connection-Oriented implementation where the sco conn del function drops a reference it does not own. This occurs because the socket stor...

PT-2026-82992

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF condition exists in the Bluetooth component. This occurs when the conn object is freed while the hci sync task is still running. The issue is specifically related to...

PT-2026-86700

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci connect acl/le sync callbacks There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that...

PT-2026-82966

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.13.0-rc4 Description A race condition exists in the Bluetooth SCO component. The function sco sock timeout runs asynchronously and acquires a socket lock. If a socket is closing while the timer is active, the...

CVE-2026-80692: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-80721: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in isoconn After isoconndel, ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel releasing the last reference to the...

PT-2026-83021

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where ISO sockets may dereference the hcon reference after the iso conn del function has been called. This occurs because the clearing...

PT-2026-86719

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso conn After iso conn del, ISO sockets should not dereference the hcon any more. Currently, clearing iso conn::hcon relies on iso conn del releasing the last reference to th...