PT-2026-116954

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Serialize ACL scheduling with channel deletion hci chan sent selects a channel under RCU but drops the read lock before accessing chan-conn and returning the channel. The ACL and LE schedulers then use its...

CVE-2026-98733: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize fragmented ISO packet queueing The fragmented path in hciqueueiso calls skbqueuetail without holding conn-dataq.lock. The socket lock serializes senders, but the transmit worker can concurrently remo...

CVE-2026-98738: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access buildpairingcmd looks up remote OOB data and copies its contents without holding hdev-lock, which serializes the list's writers. After SMP finds an entry, a concurrent management...

Linux Distros Unpatched Vulnerability : CVE-2026-98737

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: Fix inquiry cache use-after-free The sync command worker holds hdev-reqlock, but inquiry-cache updates and flushes use hdev-lock. Both...

PT-2026-116677

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci bind cis and hci connect cis return one hci conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso conn fre...

PT-2026-116680

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: validate event length before filtering is filtered packet reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command...

PT-2026-116957

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access build pairing cmd looks up remote OOB data and copies its contents without holding hdev-lock, which serializes the list's writers. After SMP finds an entry, a concurrent management...

PT-2026-116674

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMM CONNINFO The RFCOMM CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-sk state != BT CONNECTED && !rfco...

PT-2026-116679

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore subm...

PT-2026-116952

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Serialize fragmented ISO packet queueing The fragmented path in hci queue iso calls skb queue tail without holding conn-data q.lock. The socket lock serializes senders, but the transmit worker can concurrentl...

PT-2026-116953

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Serialize SCO and ISO scheduling with teardown hci low sent selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used...

Linux Distros Unpatched Vulnerability : CVE-2026-98732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintel: fix buffer over-read in btintelhwerror The Exception info %s print uses skb-data + 1, but the 12-byte payload is not guaranteed to be...

Linux Distros Unpatched Vulnerability : CVE-2026-98736

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciconn: Lock parent access during enhanced SCO setup Bluetooth: hciconn: Lock parent access during enhanced SCO setup hcienhancedsetupsync runs on t...

Linux Distros Unpatched Vulnerability : CVE-2026-98809

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync...

Linux Distros Unpatched Vulnerability : CVE-2026-98734

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcicore: Serialize SCO and ISO scheduling with teardown hcilowsent selects a connection under RCU but drops the read lock before calculating its quot...

Linux Distros Unpatched Vulnerability : CVE-2026-98819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory...

Linux Distros Unpatched Vulnerability : CVE-2026-98735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcicore: Serialize ACL scheduling with channel deletion hcichansent selects a channel under RCU but drops the read lock before accessing chan-conn an...

Linux Distros Unpatched Vulnerability : CVE-2026-98739

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who...

CVE-2026-98819: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98632: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...