PT-2026-98772

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth btintel component where the firmware ID is treated as a NUL-terminated string despite the TLV Type-Length-Value length being its only boundary. If the...

Ubuntu 24.04 LTS : Linux kernel (Azure CVM) vulnerabilities (USN-8793-1)

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8793-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

PT-2026-98769

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write exists in the l2cap ecred connect function within the Bluetooth L2CAP subsystem. The issue occurs because l2cap chan connect only counts deferred channels when...

PT-2026-98771

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists during Bluetooth device registration. In the hci register dev function, the power-on work item is queued before the initialization of hdev-adv monitors idr and th...

PT-2026-98641

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth btusb module. The functions btusb close and btusb flush use the asynchronous cancel delayed work to cancel data-rx work. If btusb rx wo...

SUSE CVE-2026-93209

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: use skbget instead of skbclone for reqskb BT enable fails intermittently with -ETIMEDOUT -110. The kernel log shows the HCI Read Local Version command was sent and the firmware replied with status 0x00 logged ...

SUSE CVE-2026-93247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...

SUSE CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

CVE-2026-84403

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device...

EUVD-2026-86458

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device...

CVE-2026-84403 Botslab G980H Dashcams Missing Authentication for Critical Function

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device...

CVE-2026-84403 Botslab G980H Dashcams Missing Authentication for Critical Function

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device...

CVE-2026-84403

The Botslab G980H dash camera firmware contains a vulnerability where it fails to require authenticated pairing or client binding for Bluetooth Low Energy (BLE) communications and GATT characteristics . This allows an unauthenticated attacker within physical Bluetooth range to intercept or retrie...

RLSA-2026:70459 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - Disallow concurrent writes in afalgsendmsg CVE-2025-39964 kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry CVE-2026-45894 kernel: crypto: ccp - Fix a...

CVE-2026-97408

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2caprecvframe currently reads that PSM unconditionally after validating only the outer L2CAP...

AZL-104042 CVE-2026-97408 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2caprecvframe currently reads that PSM unconditionally after validating only the outer L2CAP...

DEBIAN-CVE-2026-97408

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2caprecvframe currently reads that PSM unconditionally after validating only the outer L2CAP...

CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

DEBIAN-CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

AZL-103928 CVE-2026-93783 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...