CVE-2026-68394 Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

CVE-2026-68394 Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

CVE-2026-68394

In CVE-2026-68394, the Linux kernel Bluetooth MGMT path had a use-after-free in conn_update_sync triggered by MGMT_OP_LOAD_CONN_PARAM queuing a param update. The queued work incorrectly kept a borrowed hci_conn_params pointer; if userspace freed the entry before the callback ran, a use-after-free...

CVE-2026-68393 Bluetooth: hci_sync: extend conn_hash lookup critical sections

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

CVE-2026-68393

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

CVE-2026-68393 Bluetooth: hci_sync: extend conn_hash lookup critical sections

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

CVE-2026-68393

The CVE-2026-68393 entry concerns the Linux kernel Bluetooth hci_sync component. The root cause is the use of RCU-protected pointers outside their critical sections without proper reference counting, which could lead to a Use-After-Free (UAF). The fix extends the critical section to cover both th...

CVE-2026-68392 Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...

CVE-2026-68392 Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...

CVE-2026-68392

Summary: CVE-2026-68392 affects the Linux kernel Bluetooth management path. The vulnerability arises from dereferencing RCU-protected pointers outside critical sections during unpair_device/disconnect_sync, enabling a Use-After-Free (UAF) scenario. The fix targets the critical section handling fo...

CVE-2026-68392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...

CVE-2026-68391 Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

CVE-2026-68391

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

EUVD-2026-55577

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

CVE-2026-68390

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold hdev-lock for hciconnparams lookups hciconnparamslookup requires hdev-lock be held, otherwise the list iteration or param access is not safe. Hold hdev-lock for params lookups in hcisync...

CVE-2026-68389 Bluetooth: hci_qca: Clear memdump state on invalid dump size

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Clear memdump state on invalid dump size qcacontrollermemdump allocates qca-qcamemdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active,...

CVE-2026-68389

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Clear memdump state on invalid dump size qcacontrollermemdump allocates qca-qcamemdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active,...

CVE-2026-68388

In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3simplefallocaterange can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled,...

CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68385

In the Linux kernel, the following vulnerability has been resolved: s390/checksum: Fix csumpartial without vector facility Currently csumpartial calls csumcopy with copy=false and dst=NULL. On machines without the vector facility, csumcopy falls back to cksmdst, ..., causing the checksum to be...