CVE-2026-72334: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

CVE-2026-74540: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2capleconnectrsp l2capleconnectrsp obtains a channel via l2capgetchanbyident but neither holds a reference nor uses l2capchanholdunlesszero before locking and operating on it. A concurrent l2capchand...

CVE-2026-72333: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee "Bluetooth: L2CAP: Fix not tracking outstanding TX ident" changed ident allocation to use an IDA, releasing idents in l2capputident when the...

CVE-2026-74537: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...

CVE-2026-74531: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-74530: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectbigsync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previo...

CVE-2026-74510: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMTOPPAIRDEVICE command by walking hdev-mgmtpending. The lookup returned a command that was...

CVE-2026-72337: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset allocates a temporary work item and schedules doenableset on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker...

PT-2026-72985

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Bluetooth ISO implementation where hci conn::iso data is accessed and modified without a lock or Read-Copy-Update RCU mechanism. This flaw can lead to a...

CVE-2026-74535: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in isosocktimeout isosocktimeout takes locksock, so sync disabling the timer while holding that lock may deadlock. isosocktimeout may also run concurrently with isoconndel, which leads to UAF Task ...

PT-2026-72525

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Bluetooth 6LoWPAN implementation. The function lowpan enable set allocates a temporary work item and schedules do enable set on the system workqueue system...

CVE-2026-68479: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

CVE-2026-74304: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup unconditionally calls serdevdevicegetdrvdatahu-serdev and dereferences th...

CVE-2026-74532: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Validate length before parsing diagnostics TLV btinteldiagnostics accesses tlv-val0 without first validating that the diagnostics VSE is long enough to contain that field, so may cause reading data beyond the...

CVE-2026-72335: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

PT-2026-72523

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth MGMT component where a slab-use-after-free occurs during the cleanup of an advertising monitor addition failure. The function hci add adv monitor publish...

CVE-2026-74534: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel isochandel isoconnholdunlesszero isoconnlock isoconnlock conn-sk = NULL...

PT-2026-72986

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between the iso conn del and iso chan del functions in the Bluetooth ISO implementation. This race can lead to a double-put of the iso conn reference count,...

PT-2026-72740

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the Bluetooth component when handling non-serdev devices. The qca setup function unconditionally calls serdev device get drvdata using the hu-serdev...

PT-2026-72191

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the rtlbt parse firmware function fails to properly validate firmware patch bounds. When processing a malformed firmware patch shorter th...