CVE-2026-90091 Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...

CVE-2026-90089 Bluetooth: btnxpuart: Validate the FW dump header length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Validate the FW dump header length nxpprocessfwdump pulls the ACL header off the frame and then reads seqnum and buflen from a struct nxpfwdumphdr placed at skb-data, without checking that the ACL payload is...

CVE-2026-90087 Bluetooth: do not leak an hci_conn when a second LE connect is rejected

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: do not leak an hciconn when a second LE connect is rejected createleconncomplete decides whether the failed connection is still pending by comparing it against hcilookupleconnect, which returns the first LE connection ...

EUVD-2026-81948

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: do not leak an hciconn when a second LE connect is rejected createleconncomplete decides whether the failed connection is still pending by comparing it against hcilookupleconnect, which returns the first LE connection ...

CVE-2026-90087

CVE-2026-90087 is a Linux kernel Bluetooth (HCI) resource leak affecting the handling of concurrent LE (BLE) connection attempts. When two connections are in BT_CONNECT simultaneously—specifically one on the passive scan path with HCI_CONN_SCANNING set—create_le_conn_complete() may match the wron...

CVE-2026-90087 Bluetooth: do not leak an hci_conn when a second LE connect is rejected

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: do not leak an hciconn when a second LE connect is rejected createleconncomplete decides whether the failed connection is still pending by comparing it against hcilookupleconnect, which returns the first LE connection ...

CVE-2026-90252: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmthcicmdsync queues the pending command with a NULL destroy callback, so it is only freed if sendhcicmdsync runs. A cancelled entry is leaked, as hcicmdsynccancelentry...

PT-2026-94600

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Bluetooth MGMT component when an HCI command is cancelled. The mgmt hci cmd sync function queues pending commands with a NULL destroy callback, meaning they a...

CVE-2026-90253: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled meshsendcancel queues the pending command with a NULL destroy callback, so it is only freed if sendcancel runs. A cancelled entry is leaked, as...

CVE-2026-90090: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdiotxpacket rounds the transfer size up to the SDIO block size of 256 bytes, but hands the host controller the SKB buffer as is: err = sdiowritesbbdev-func,...

PT-2026-94437

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth btnxpuart component where the nxp process fw dump function reads seq num and buf len from a nxp fw dump hdr structure without verifying if the ACL payloa...

CVE-2026-90093: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan-conn safely in get/setsockopt Since commit b66774b48dd9 "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref" l2capchan::conn has held reference and remains non-NULL also after the...

PT-2026-94435

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth subsystem where an hci conn is leaked when a second Low Energy LE connection attempt is rejected. This occurs because the create le conn complete functio...

PT-2026-94440

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth L2CAP implementation. The problem occurs because a new socket may be added to the parent socket accept queue after the l2cap sock clean...

PT-2026-94603

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where hci setup sync queues a conn handle t with a NULL destroy callback. This leads to a memory leak if the entry is cancelled, as hci cmd syn...

CVE-2026-90092: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in l2capsockteardowncb and state set to BTCLOSED, as that can result to...

PT-2026-94441

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth L2CAP implementation where l2cap chan::conn retains a reference and remains non-NULL even after the associated hci conn is deleted. Accessing fields such...

CVE-2026-90256: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use protolock for l2capdata to fix l2capdisconnind hciconn::l2capdata is accessed without locks in l2capdisconnind via hciconntimeout discwork - hciprotodisconnind - l2capdisconnind. This is UAF if the l2capconn...

PT-2026-94601

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Bluetooth MGMT component when a mesh send cancel command is cancelled. The mesh send cancel function queues a pending command with a NULL destroy callback,...

PT-2026-94604

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth L2CAP implementation. The l2cap data member of hci conn is accessed without proper locking within the l2cap disconn ind function, which...