Linux Distros Unpatched Vulnerability : CVE-2026-74508

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: HIDP: reject frames without a transaction header hidprecvctrlframe and hidprecvintrframe read skb-data0 before checking that the L2CAP SDU contains a...

Linux Distros Unpatched Vulnerability : CVE-2026-74535

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: avoid deadlocks in isosocktimeout isosocktimeout takes locksock, so sync disabling the timer while holding that lock may deadlock. isosocktimeou...

Linux Distros Unpatched Vulnerability : CVE-2026-74532

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintel: Validate length before parsing diagnostics TLV btinteldiagnostics accesses tlv-val0 without first validating that the diagnostics VSE is lon...

Linux Distros Unpatched Vulnerability : CVE-2026-72336

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before...

Linux Distros Unpatched Vulnerability : CVE-2026-74538

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the ev3 part of isoconnectind. It may also be NULL if...

Linux Distros Unpatched Vulnerability : CVE-2026-74536

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix leaking sk after socket release isosockkill tests !sockflagsk, SOCKZAPPED || sk-sksocket || sockflagsk, SOCKDEAD for early return, but this ...

Linux Distros Unpatched Vulnerability : CVE-2026-74534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel...

Linux Distros Unpatched Vulnerability : CVE-2026-72334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject...

PT-2026-72740

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci qca: fix NULL pointer dereference in qca setup for non-serdev device hu-serdev is NULL for hci uart attached via non-serdev paths, but qca setup unconditionally calls serdev device get drvdatahu-serdev and...

PT-2026-72960

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidp recv ctrl frame and hidp recv intr frame read skb-data0 before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty...

PT-2026-72961

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix advertising data UAFs hci find adv instance returns an adv info pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in so...

PT-2026-72523

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci add adv monitor publishes a new adv monitor in hdev-adv monitors idr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

PT-2026-72959

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidp get raw report waits for a numbered report, hidp process data compares the expected report number with skb-data0. A connected HIDP peer can reply with only a DATA...

PT-2026-72982

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci connect big sync callback There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the...

PT-2026-72985

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref get unless zero hci conn::iso data is accessed and modified without lock or RCU. This leads to a race Task hdev-workqueue Task 2 iso recv iso conn putconn conn = LOAD hcon-iso data iso co...

PT-2026-72522

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO END/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISO CONT, ISO END packets. We currently reject them if they are last. If controller sends malformed sequence ISO...

PT-2026-72736

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci read codec...

Linux Distros Unpatched Vulnerability : CVE-2026-74509

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: Fix advertising data UAFs hcifindadvinstance returns an advinfo pointer that is valid only while hdev-lock is held. The advertising...

Linux Distros Unpatched Vulnerability : CVE-2026-74541

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: clear isodata always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-isodata = NULL is necessary, otherwise later...

Linux Distros Unpatched Vulnerability : CVE-2026-74531

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid...