CVE-2026-74534: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel isochandel isoconnholdunlesszero isoconnlock isoconnlock conn-sk = NULL...

PT-2026-72986

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between the iso conn del and iso chan del functions in the Bluetooth ISO implementation. This race can lead to a double-put of the iso conn reference count,...

PT-2026-72985

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Bluetooth ISO implementation where hci conn::iso data is accessed and modified without a lock or Read-Copy-Update RCU mechanism. This flaw can lead to a...

CVE-2026-74303: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, causing a NULL...

PT-2026-72981

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF condition exists in the Bluetooth component. This occurs when the conn object is freed while the hci sync task is still running, specifically within the hci connect ...

PT-2026-72982

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A theoretical Use-After-Free UAF issue exists in the Bluetooth component. This occurs if the connection is freed while the hci sync task is running. The problem is located within the hci...

CVE-2026-74529: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-74530: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectbigsync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previo...

CVE-2026-74537: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk is currently accessed without either: Task 1 Task 2...

PT-2026-72984

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the btintel diagnostics function accesses tlv-val0 without verifying if the diagnostics VSE Vendor Specific Element is sufficiently long ...

CVE-2026-74532: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Validate length before parsing diagnostics TLV btinteldiagnostics accesses tlv-val0 without first validating that the diagnostics VSE is long enough to contain that field, so may cause reading data beyond the...

PT-2026-72191

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the rtlbt parse firmware function fails to properly validate firmware patch bounds. When processing a malformed firmware patch shorter th...

PT-2026-72740

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the Bluetooth component when handling non-serdev devices. The qca setup function unconditionally calls serdev device get drvdata using the hu-serdev...

PT-2026-72987

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where the iso sock timeout function acquires lock sock. Synchronously disabling the timer while holding this lock can result in a...

CVE-2026-74508: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidprecvctrlframe and hidprecvintrframe read skb-data0 before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mo...

Linux Distros Unpatched Vulnerability : CVE-2026-74511

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: mgmt: fix pending command UAF in EIR updates MGMTOPSETLOCALNAME is handled asynchronously on powered controllers and can run setnamesync. When the...

PT-2026-72963

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth management component during Extended Inquiry Response EIR updates. The MGMT OP SET LOCAL NAME command is handled asynchronously and can...

PT-2026-72959

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth HIDP HID over SDP implementation where the hidp process data function fails to validate the payload of numbered reports. When hidp get raw report waits f...

CVE-2026-74539: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...

CVE-2026-74538: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...