PT-2026-72984

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Validate length before parsing diagnostics TLV btintel diagnostics accesses tlv-val0 without first validating that the diagnostics VSE is long enough to contain that field, so may cause reading data beyond the...

PT-2026-72963

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT OP SET LOCAL NAME is handled asynchronously on powered controllers and can run set name sync. When the controller is BR/EDR capable, set name sync updates the local nam...

PT-2026-72992

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2cap le connect rsp l2cap le connect rsp obtains a channel via l2cap get chan by ident but neither holds a reference nor uses l2cap chan hold unless zero before locking and operating on it. A...

PT-2026-72993

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear iso data always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-iso data = NULL is necessary, otherwise later iso conn free will UAF. Fix clearing of iso data in iso sock disconn...

PT-2026-72990

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso connect ind Accessing iso pisk-conn requires lock sock, which is not taken in the "ev3" part of iso connect ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states...

PT-2026-72986

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso conn iso conn del and iso chan del have a race that results to double-put of iso conn: Task hdev-workqueue Task 2 iso conn del iso chan del iso conn hold unless zero iso conn lock iso conn...

PT-2026-72987

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso sock timeout iso sock timeout takes lock sock, so sync disabling the timer while holding that lock may deadlock. iso sock timeout may also run concurrently with iso conn del, which leads to...

PT-2026-72191

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt parse firmware copies patch length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction...

Linux Distros Unpatched Vulnerability : CVE-2026-74510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMTOPPAIRDEVICE command b...

Linux Distros Unpatched Vulnerability : CVE-2026-74529

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avo...

Linux Distros Unpatched Vulnerability : CVE-2026-74530

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: hold conn in hciconnectbigsync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to...

PT-2026-72983

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: hold conn reference in abort conn sync There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that...

Linux Distros Unpatched Vulnerability : CVE-2026-74537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close...

Linux Distros Unpatched Vulnerability : CVE-2026-72333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee Bluetooth: L2CAP: Fix not tracking outstanding TX ident changed ident...

Linux Distros Unpatched Vulnerability : CVE-2026-74511

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: mgmt: fix pending command UAF in EIR updates MGMTOPSETLOCALNAME is handled asynchronously on powered controllers and can run setnamesync. When the...

PT-2026-72524

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control get l2cap conn looks up an LE hci conn under hdev protection, but then drops that protection before reading hcon-l2cap data and before lowpan control write later...

PT-2026-72525

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpan enable set allocates a temporary work item and schedules do enable set on system wq, then returns to debugfs. The debugfs active operation has ended at that point, but the...

PT-2026-72991

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso sock getname Accessing iso pisk-conn requires lock sock, which is not held here. Fix by adding the lock/release...

PT-2026-72988

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release iso sock kill tests !sock flagsk, SOCK ZAPPED || sk-sk socket || sock flagsk, SOCK DEAD for early return, but this is always true since sock orphansk sets SOCK DEAD, so the sk...

Linux Distros Unpatched Vulnerability : CVE-2026-74533

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix race of kfree vs krefgetunlesszero hciconn::isodata is accessed and modified without lock or RCU. This leads to a race Task hdev-workqueue...