CVE-2026-68095

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

UBUNTU-CVE-2026-68095

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

EUVD-2026-55580

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

CVE-2026-68394 Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

CVE-2026-68394

In CVE-2026-68394, the Linux kernel Bluetooth MGMT path had a use-after-free in conn_update_sync triggered by MGMT_OP_LOAD_CONN_PARAM queuing a param update. The queued work incorrectly kept a borrowed hci_conn_params pointer; if userspace freed the entry before the callback ran, a use-after-free...

EUVD-2026-55579

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

CVE-2026-68393

The CVE-2026-68393 entry concerns the Linux kernel Bluetooth hci_sync component. The root cause is the use of RCU-protected pointers outside their critical sections without proper reference counting, which could lead to a Use-After-Free (UAF). The fix extends the critical section to cover both th...

EUVD-2026-55578

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...

CVE-2026-68392

Summary: CVE-2026-68392 affects the Linux kernel Bluetooth management path. The vulnerability arises from dereferencing RCU-protected pointers outside critical sections during unpair_device/disconnect_sync, enabling a Use-After-Free (UAF) scenario. The fix targets the critical section handling fo...

CVE-2026-68391

CVE-2026-68391 affects the Linux kernel Bluetooth management path, specifically the mgmt_pending_cmds handling of hci_conn references. The issue is a Use-After-Free risk from dereferencing RCU-protected pointers outside critical sections and from using hci_conn in hci_sync callbacks without holdi...

CVE-2026-68391 Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

CVE-2026-68390 Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold hdev-lock for hciconnparams lookups hciconnparamslookup requires hdev-lock be held, otherwise the list iteration or param access is not safe. Hold hdev-lock for params lookups in hcisync...

EUVD-2026-55576

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold hdev-lock for hciconnparams lookups hciconnparamslookup requires hdev-lock be held, otherwise the list iteration or param access is not safe. Hold hdev-lock for params lookups in hcisync...

CVE-2026-68390

The CVE-2026-68390 affects the Linux kernel Bluetooth subsystem (hci_sync), where hci_conn_params_lookup must hold hdev->lock during list iterations and parameter access. The issue could allow unsafe access and potentially data corruption or system instability if the lock is not held. The vuln...

CVE-2026-68381

CVE-2026-68381 affects the Linux kernel ksmbd (SMB server) and describes a race between connection teardown and asynchronous oplock/lease break notifications. The vulnerability occurs when a ksmbd_conn pointer is stored in an async work item and queued on ksmbd-io; the work only increments conn-&...

CVE-2026-68381 ksmbd: pin conn during async oplock break notification

In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2oplockbreaknoti and smb2leasebreaknoti store a ksmbdconn pointer in an async ksmbdwork and then queue that work on ksmbd-io. The work only increments conn-rcount, which...

CVE-2026-68381 ksmbd: pin conn during async oplock break notification

In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2oplockbreaknoti and smb2leasebreaknoti store a ksmbdconn pointer in an async ksmbdwork and then queue that work on ksmbd-io. The work only increments conn-rcount, which...

EUVD-2026-55567

In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2oplockbreaknoti and smb2leasebreaknoti store a ksmbdconn pointer in an async ksmbdwork and then queue that work on ksmbd-io. The work only increments conn-rcount, which...

EUVD-2026-55412

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: guard link STA in decap offload mt7925stasetdecapoffload iterates over the vif validlinks mask when updating decap offload state for an MLO station. The station may not have a link STA for every valid link of...

CVE-2026-68188 Bluetooth: RFCOMM: Fix session UAF in set_termios

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in settermios rfcommttysettermios tests dlc-session without rfcommmutex and later passes the pointer to rfcommsendrpn. The latter dereferences both session-initiator and session-sock. Meanwhile,...