CVE-2026-89034

TCH QRing smart ring model R20B006 running firmware RT09R201.00.00250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service...

SUSE CVE-2026-89569

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

CVE-2026-85104

In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters...

CVE-2026-85104 Brain stimulation parameters can be modified via Bluetooth in Sooma

In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters...

EUVD-2026-80739

In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters...

CVE-2026-85104 Brain stimulation parameters can be modified via Bluetooth in Sooma

In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters...

CVE-2026-85104

CVE-2026-85104 affects the Sooma 2GEN brain stimulator. An attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters, meaning no credentials are required to alter therapy settings on the device. The vulnerability is classified with a CVSS 4.0 base score of 5...

AZL-101162 CVE-2026-89999 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing. After the report-id gate it unconditionally calls wacomintuospro2btpen a...

CVE-2026-89999

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing. After the report-id gate it unconditionally calls wacomintuospro2btpen a...

DEBIAN-CVE-2026-89999

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing. After the report-id gate it unconditionally calls wacomintuospro2btpen a...

CVE-2026-89999 HID: wacom: validate report length in wacom_intuos_pro2_bt_irq

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing. After the report-id gate it unconditionally calls wacomintuospro2btpen a...

CVE-2026-89999 HID: wacom: validate report length in wacom_intuos_pro2_bt_irq

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing. After the report-id gate it unconditionally calls wacomintuospro2btpen a...

CVE-2026-89999

CVE-2026-89999 is an out-of-bounds read in the Linux kernel's HID wacom driver , specifically in wacom_intuos_pro2_bt_irq(). The function receives the wire report length but never validates it before parsing; sub-parsers dereference wacom->data at fixed offsets (up to byte 285 for INTUOSP2_BT/...

EUVD-2026-80607

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing. After the report-id gate it unconditionally calls wacomintuospro2btpen a...

CVE-2026-89774

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

DEBIAN-CVE-2026-89774

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

UBUNTU-CVE-2026-89774

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

CVE-2026-89774

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

EUVD-2026-80255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

CVE-2026-89774

CVE-2026-89774 is a Use-After-Free (UAF) in the Linux kernel's Bluetooth SCO subsystem, specifically in sco_conn_ready(). The socket (conn->sk) and its parent are dereferenced without holding a refcount or under conn->lock, allowing a concurrent sco_sock_release() to free the socket before ...