PT-2026-116681

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hci conn" made hci bind cis and hci connect cis return a connection with one hold for the ISO layer. hci bind...

PT-2026-94603

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where hci setup sync queues a conn handle t with a NULL destroy callback. This leads to a memory leak if the entry is cancelled, as hci cmd syn...

PT-2026-94435

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth subsystem where an hci conn is leaked when a second Low Energy LE connection attempt is rejected. This occurs because the create le conn complete functio...

PT-2026-94604

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth L2CAP implementation. The l2cap data member of hci conn is accessed without proper locking within the l2cap disconn ind function, which...

UBUNTU-CVE-2026-74531

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

SUSE CVE-2026-68394

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

CVE-2026-68394

In CVE-2026-68394, the Linux kernel Bluetooth MGMT path had a use-after-free in conn_update_sync triggered by MGMT_OP_LOAD_CONN_PARAM queuing a param update. The queued work incorrectly kept a borrowed hci_conn_params pointer; if userspace freed the entry before the callback ran, a use-after-free...

PT-2026-69790

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the hci sync function fails to hold the hdev-lock during hci conn params lookups. This lack of locking makes list iteration or parameter...

PT-2026-69793

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where RCU-protected pointers are used outside of critical sections without a refcount, which may lead to a Use-After-Free UAF condition. UAF...

CVE-2026-64433

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete adddevicecomplete runs from the hcicmdsyncwork kworker, which holds only hcireqsynclock and not hcidevlock. It calls hciconnparamslookup and then dereferences the...

Linux Distros Unpatched Vulnerability : CVE-2026-64433

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete adddevicecomplete runs from...

Linux Distros Unpatched Vulnerability : CVE-2026-53072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: fix locking in hciconnrequestevt with HCIPROTODEFER When protocol sets HCIPROTODEFER, hciconnrequestevt calls hciconnectcfmconn without hdev-lock...

CVE-2026-53072 Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hciconnrequestevt with HCIPROTODEFER When protocol sets HCIPROTODEFER, hciconnrequestevt calls hciconnectcfmconn without hdev-lock. Generally hciconnectcfm assumes it is held, and if conn is deleted...

CVE-2026-53072 Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hciconnrequestevt with HCIPROTODEFER When protocol sets HCIPROTODEFER, hciconnrequestevt calls hciconnectcfmconn without hdev-lock. Generally hciconnectcfm assumes it is held, and if conn is deleted...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005561)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005561 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Add error handling to pairdevice hciconnparamsadd never checks for a NULL value...

kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue

A flaw was discovered in the Bluetooth subsystem of the Linux kernel. When processing a HCIEVNUMCOMPPKTS event, the function hciconntxdequeue did not properly hold or release the hdev device lock, which may lead to a use-after-free of the connection structure...

ALSA-2025:22854 Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: cifs: Fix oops due to uninitialised variable CVE-2025-38737 kernel: can: j1939: implement NETDEVUNREGISTER notification handler CVE-2025-39925 kernel: Bluetooth: hcievent: Fix UAF in...

Linux Distros Unpatched Vulnerability : CVE-2025-39983

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciconntxdequeue This fixes the following UAF caused by not...

CVE-2025-39983

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciconntxdequeue This fixes the following UAF caused by not properly locking hdev when processing HCIEVNUMCOMPPKTS: BUG: KASAN: slab-use-after-free in hciconntxdequeue+0x1be/0x220...

CVE-2025-39983 Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciconntxdequeue This fixes the following UAF caused by not properly locking hdev when processing HCIEVNUMCOMPPKTS: BUG: KASAN: slab-use-after-free in hciconntxdequeue+0x1be/0x220...