CVE-2026-98107

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...

CVE-2026-98108

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...

CVE-2026-98107

The Linux kernel Bluetooth L2CAP component contains an out-of-bounds write vulnerability in l2cap_ecred_connect. The root cause is in l2cap_chan_connect(), where the check for pending ECRED channels incorrectly counts only deferred channels. Specifically, if 6 L2CAP sockets are connected in a spe...

CVE-2026-98108 Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...

CVE-2026-98108

The Linux kernel Bluetooth L2CAP component contains a vulnerability where l2cap_le_connect_req() fails to correctly set the channel mode, potentially allowing FLAG_DEFER_SETUP channels to send incorrect L2CAP_ECRED_CONN_RSP replies. Furthermore, because the function fails to limit the number of d...

EUVD-2026-86939

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...

CVE-2026-98107 Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...

CVE-2026-98108 Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...

CVE-2026-97977 Bluetooth: btusb: Fix UAF of btusb_data by rx_work

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix UAF of btusbdata by rxwork btusbclose and btusbflush cancel data-rxwork with the asynchronous canceldelayedwork, so if btusbrxwork is already running on another CPU it keeps running after the cancel returns...

CVE-2026-97977

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix UAF of btusbdata by rxwork btusbclose and btusbflush cancel data-rxwork with the asynchronous canceldelayedwork, so if btusbrxwork is already running on another CPU it keeps running after the cancel returns...

CVE-2026-97976

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate packetlen before skbputdata btintelpciesubmitrxwork reads packetlen from rfhhdr without checking if it exceeds the RX buffer size. An oversized packetlen can lead to an out-of-bounds read in...

CVE-2026-97976

The Linux kernel contains a vulnerability in the btintel_pcie driver. The function btintel_pcie_submit_rx_work() fails to verify if packet_len read from rfh_hdr exceeds the RX buffer size, potentially leading to an out-of-bounds read in skb_put_data(). Remediation involves validating that packet_...

CVE-2026-97976 Bluetooth: btintel_pcie: validate packet_len before skb_put_data

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate packetlen before skbputdata btintelpciesubmitrxwork reads packetlen from rfhhdr without checking if it exceeds the RX buffer size. An oversized packetlen can lead to an out-of-bounds read in...

CVE-2026-97975 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

EUVD-2026-86629

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-97975

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-97975

The Linux kernel contains a NULL pointer dereference vulnerability in the Bluetooth hci_sysfs component. A race condition exists between hci_conn_del_sysfs() and concurrent child device unregistration (such as a BNEP network device calling unregister_netdev()). During unregistration, device_del()...

CVE-2026-97975 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-97907 Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When keyid from chip is zero, rtlbtparsefirmwarev2 intentionally ignores all security headers. However, the implementation simply breaks from a switch...

EUVD-2026-86761

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When keyid from chip is zero, rtlbtparsefirmwarev2 intentionally ignores all security headers. However, the implementation simply breaks from a switch...