CVE-2026-98107: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...

Linux Distros Unpatched Vulnerability : CVE-2026-98111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintel: validate version TLV value lengths btintelparseversiontlv verifies that a complete TLV is present in the response, but it does not ensure th...

Linux Distros Unpatched Vulnerability : CVE-2026-97977

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btusb: Fix UAF of btusbdata by rxwork btusbclose and btusbflush cancel data-rxwork with the asynchronous canceldelayedwork, so if btusbrxwork is...

Linux Distros Unpatched Vulnerability : CVE-2026-97908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. T...

Linux Distros Unpatched Vulnerability : CVE-2026-97975

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device i...

Ubuntu 24.04 LTS : Linux kernel (Azure CVM) vulnerabilities (USN-8793-1)

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8793-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

Linux Distros Unpatched Vulnerability : CVE-2026-98107

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED...

Linux Distros Unpatched Vulnerability : CVE-2026-93209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcicore: use skbget instead of skbclone for reqskb BT enable fails intermittently with -ETIMEDOUT -110. The kernel log shows the HCI Read Local Versi...

Linux Distros Unpatched Vulnerability : CVE-2026-97976

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintelpcie: validate packetlen before skbputdata btintelpciesubmitrxwork reads packetlen from rfhhdr without checking if it exceeds the RX buffer...

CVE-2026-97975

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-98110: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

CVE-2026-98109: Concurrent Execution using Shared Resource with Improper Synchronization

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing hdev-advmonitorsidr and registering the MSFT extension via msftregister...

PT-2026-98771

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists during Bluetooth device registration. In the hci register dev function, the power-on work item is queued before the initialization of hdev-adv monitors idr and th...

CVE-2026-98108: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...

CVE-2026-98111: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintelparseversiontlv verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value...

CVE-2026-97907: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When keyid from chip is zero, rtlbtparsefirmwarev2 intentionally ignores all security headers. However, the implementation simply breaks from a switch...

CVE-2026-97908: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...

CVE-2026-98107

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...

CVE-2026-97908

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...

CVE-2026-97907

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When keyid from chip is zero, rtlbtparsefirmwarev2 intentionally ignores all security headers. However, the implementation simply breaks from a switch...