CVE-2026-98294 Bluetooth: hci_qca: Do not write to the serial port after it is closed

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Do not write to the serial port after it is closed hciuartclose closes the serdev port if HCIQUIRKNONPERSISTENTSETUP is set for example, for the WCN399x family. A failed hcidevopensync following a successful...

EUVD-2026-93222

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Do not write to the serial port after it is closed hciuartclose closes the serdev port if HCIQUIRKNONPERSISTENTSETUP is set for example, for the WCN399x family. A failed hcidevopensync following a successful...

CVE-2026-98294

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Do not write to the serial port after it is closed hciuartclose closes the serdev port if HCIQUIRKNONPERSISTENTSETUP is set for example, for the WCN399x family. A failed hcidevopensync following a successful...

CVE-2026-98294 Bluetooth: hci_qca: Do not write to the serial port after it is closed

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Do not write to the serial port after it is closed hciuartclose closes the serdev port if HCIQUIRKNONPERSISTENTSETUP is set for example, for the WCN399x family. A failed hcidevopensync following a successful...

CVE-2026-98293 Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in isoconnready isogetsock returns the parent socket with a reference held, which is dropped by sockput once the child socket has been set up. The error path taken when isosockalloc fails on...

EUVD-2026-93221

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in isoconnready isogetsock returns the parent socket with a reference held, which is dropped by sockput once the child socket has been set up. The error path taken when isosockalloc fails on...

CVE-2026-98293

The Linux kernel contains a memory leak vulnerability within the Bluetooth ISO component. Specifically, the iso_conn_ready() function fails to properly release a reference to the parent socket when iso_sock_alloc() fails. While the reference is normally dropped by sock_put() upon successful child...

CVE-2026-98293 Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in isoconnready isogetsock returns the parent socket with a reference held, which is dropped by sockput once the child socket has been set up. The error path taken when isosockalloc fails on...

CVE-2026-98293

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in isoconnready isogetsock returns the parent socket with a reference held, which is dropped by sockput once the child socket has been set up. The error path taken when isosockalloc fails on...

EUVD-2026-93219

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix off-by-one bounds check in RX submit btintelpciesubmitrx used frbdindex rxq-count to guard the FRBD array access, allowing frbdindex == rxq-count to pass through and index one element past the end of t...

CVE-2026-98291

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix off-by-one bounds check in RX submit btintelpciesubmitrx used frbdindex rxq-count to guard the FRBD array access, allowing frbdindex == rxq-count to pass through and index one element past the end of t...

CVE-2026-98292 Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtkhciwmtevt and read its op/flag fields without checking the event is lon...

CVE-2026-98290

The Linux kernel contains a potential deadlock in the Bluetooth RFCOMM component. Specifically, rfcomm_sock_cleanup_listen() closes unaccepted child sockets using rfcomm_sock_close(), which acquires the child socket lock before rfcomm_dlc_close() acquires the rfcomm_mutex. Because the RFCOMM work...

EUVD-2026-93218

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

CVE-2026-98290 Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

CVE-2026-98290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

CVE-2026-98290 Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets through rfcommsockclose, which takes the child socket lock before rfcommdlcclose acquires rfcommmutex. The...

CVE-2026-98247 Bluetooth: hci_codec: validate vendor codec count length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

EUVD-2026-93175

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

CVE-2026-98247

The Linux kernel contains a vulnerability in the Bluetooth hci_codec component. The Read Local Supported Codecs parsers incorrectly consume variable-sized standard codec arrays before parsing the vendor codec count. Because the initial reply-size check does not guarantee the vendor count byte rem...