SUSE-SU-2026:22903-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 bsc1243603. - CVE-2026-31503: udp: Fix wildcard bind...

CVE-2026-16473

The CVE-2026-16473 vulnerability affects the sbc library used by the BlueZ SBC codec. A off-by-one bug in the SBC frame decoder enables a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of a...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

EUVD-2026-47623

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473 Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory. Mitigation...

CVE-2026-16473 Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock

...

RLSA-2026:42552 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: RDMA/mana: Remove user triggerable WARNON in manaibcreateqprss CVE-2026-46117 kernel: Bluetooth: l2cap: Add missing chan lock in l2capecredreconfrsp CVE-2026-53071 Bug Fixes and...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

The vulnerability of the hci_add_adv_monitor() function in the net/bluetooth/hci_core.c module of the Linux kernel’s Bluetooth subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hciaddadvmonitor function in the net/bluetooth/hcicore.c module of the Linux kernel’s Bluetooth subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the hci_abort_conn_sync() function in the net/bluetooth/hciSync.c module of the Bluetooth subsystem in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hciabortconnsync function in the net/bluetooth/hciSync.c module of the Bluetooth subsystem in the Linux operating system is related to the reutilization of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

RockyLinux 8 : kernel-rt (RLSA-2026:42550)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42550 advisory. kernel: RDMA/mana: Remove user triggerable WARNON in manaibcreateqprss CVE-2026-46117 kernel: Bluetooth: l2cap: Add missing chan lock in...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: scsi: core: Wake up the error handler when final completions race against each other CVE-2026-23110...

ALSA-2026:43307 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: scsi: core: Wake up the error handler when final completions race against each other CVE-2026-23110...

CVE-2026-63991

A flaw was found in the Linux kernel's Bluetooth 6lowpan module. This vulnerability occurs because the sendmcastpkt function does not properly check the return value of skbclone, which can be null if memory allocation fails. An attacker could exploit this by triggering a scenario where skbclone...

CVE-2026-63975

A flaw was found in the Bluetooth L2CAP Logical Link Control and Adaptation Protocol component of the Linux kernel. When a device receives a connection response with an already-assigned destination Channel Identifier CID, the system may crash. This occurs because the kernel's procedure for...

CVE-2026-63948

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP component. A reference leak occurs in the l2capchantimeout function. When a channel's connection is null, an early exit path in the function fails to release a held channel reference. This oversigh...

CVE-2026-10680

The Classic BR/EDR L2CAP signaling handlers l2capbrconfreq and l2capbrconfrsp in subsys/bluetooth/host/classic/l2capbr.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling header...