Linux Distros Unpatched Vulnerability : CVE-2026-90092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in...

Linux Distros Unpatched Vulnerability : CVE-2026-90090

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdiotxpacket rounds the transfer size up to the SDIO block size of 256 bytes, but hands th...

Linux Distros Unpatched Vulnerability : CVE-2026-90089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btnxpuart: Validate the FW dump header length nxpprocessfwdump pulls the ACL header off the frame and then reads seqnum and buflen from a struct...

Linux Distros Unpatched Vulnerability : CVE-2026-90252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: free the HCI command when it is cancelled mgmthcicmdsync queues the pending command with a NULL destroy callback, so it is only freed if...

Linux Distros Unpatched Vulnerability : CVE-2026-90253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: free the mesh send cancel command when it is cancelled meshsendcancel queues the pending command with a NULL destroy callback, so it is only...

Linux Distros Unpatched Vulnerability : CVE-2026-90255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if...

ROS-20260918-73-0030

The vulnerability in the net/bluetooth/mgmt.c module of the Linux operating system is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-90251

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...

AZL-102335 CVE-2026-90253 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled meshsendcancel queues the pending command with a NULL destroy callback, so it is only freed if sendcancel runs. A cancelled entry is leaked, as...

CVE-2026-90252

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmthcicmdsync queues the pending command with a NULL destroy callback, so it is only freed if sendhcicmdsync runs. A cancelled entry is leaked, as hcicmdsynccancelentry...

AZL-101909 CVE-2026-90256 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use protolock for l2capdata to fix l2capdisconnind hciconn::l2capdata is accessed without locks in l2capdisconnind via hciconntimeout discwork - hciprotodisconnind - l2capdisconnind. This is UAF if the l2capconn...

AZL-102443 CVE-2026-90251 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...

DEBIAN-CVE-2026-90254

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: free the advertising instance on the failure and cancel paths advtimeoutexpire hands a kmalloced instance byte to hcicmdsyncqueue with a NULL destroy callback, and only advtimeoutexpiresync frees it. That leak...

AZL-102884 CVE-2026-90254 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: free the advertising instance on the failure and cancel paths advtimeoutexpire hands a kmalloced instance byte to hcicmdsyncqueue with a NULL destroy callback, and only advtimeoutexpiresync frees it. That leak...

DEBIAN-CVE-2026-90252

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmthcicmdsync queues the pending command with a NULL destroy callback, so it is only freed if sendhcicmdsync runs. A cancelled entry is leaked, as hcicmdsynccancelentry...

CVE-2026-90253

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled meshsendcancel queues the pending command with a NULL destroy callback, so it is only freed if sendcancel runs. A cancelled entry is leaked, as...

DEBIAN-CVE-2026-90251

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...

DEBIAN-CVE-2026-90253

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled meshsendcancel queues the pending command with a NULL destroy callback, so it is only freed if sendcancel runs. A cancelled entry is leaked, as...

AZL-102689 CVE-2026-90093 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan-conn safely in get/setsockopt Since commit b66774b48dd9 "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref" l2capchan::conn has held reference and remains non-NULL also after the...

AZL-102075 CVE-2026-90090 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdiotxpacket rounds the transfer size up to the SDIO block size of 256 bytes, but hands the host controller the SKB buffer as is: err = sdiowritesbbdev-func,...