PT-2026-72987

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso sock timeout iso sock timeout takes lock sock, so sync disabling the timer while holding that lock may deadlock. iso sock timeout may also run concurrently with iso conn del, which leads to...

PT-2026-72993

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear iso data always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-iso data = NULL is necessary, otherwise later iso conn free will UAF. Fix clearing of iso data in iso sock disconn...

PT-2026-72990

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso connect ind Accessing iso pisk-conn requires lock sock, which is not taken in the "ev3" part of iso connect ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states...

PT-2026-72983

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: hold conn reference in abort conn sync There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that...

PT-2026-72981

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci connect pa sync callback There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that...

PT-2026-72191

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt parse firmware copies patch length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction...

PT-2026-72962

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMT OP PAIR DEVICE command by walking hdev-mgmt pending. The lookup returned a command that wa...

PT-2026-72984

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Validate length before parsing diagnostics TLV btintel diagnostics accesses tlv-val0 without first validating that the diagnostics VSE is long enough to contain that field, so may cause reading data beyond the...

Linux Distros Unpatched Vulnerability : CVE-2026-74510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMTOPPAIRDEVICE command b...

Linux Distros Unpatched Vulnerability : CVE-2026-74537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close...

PT-2026-72980

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci past sync callback Avoids giving freed pointers to hci conn valid, which kmalloc may have reused. Hold refcount to avoid that...

PT-2026-72963

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT OP SET LOCAL NAME is handled asynchronously on powered controllers and can run set name sync. When the controller is BR/EDR capable, set name sync updates the local nam...

Linux Distros Unpatched Vulnerability : CVE-2026-74529

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avo...

Linux Distros Unpatched Vulnerability : CVE-2026-72333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee Bluetooth: L2CAP: Fix not tracking outstanding TX ident changed ident...

Linux Distros Unpatched Vulnerability : CVE-2026-74530

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: hold conn in hciconnectbigsync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to...

Linux Distros Unpatched Vulnerability : CVE-2026-74508

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: HIDP: reject frames without a transaction header hidprecvctrlframe and hidprecvintrframe read skb-data0 before checking that the L2CAP SDU contains a...

Linux Distros Unpatched Vulnerability : CVE-2026-72334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject...

Linux Distros Unpatched Vulnerability : CVE-2026-74532

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintel: Validate length before parsing diagnostics TLV btinteldiagnostics accesses tlv-val0 without first validating that the diagnostics VSE is lon...

Linux Distros Unpatched Vulnerability : CVE-2026-72336

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before...

Linux Distros Unpatched Vulnerability : CVE-2026-74538

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the ev3 part of isoconnectind. It may also be NULL if...