PT-2026-106575

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Serialize local codec list cleanup hci dev close sync clears hdev-local codecs after releasing hdev-lock. Codec list additions and both traversals in sco sock getsockopt use that lock, but the close path does...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Fixed a memory leak in hcireqsyncComplete In the function hcireqsyncComplete, always free the previous sync request state before assigning a reference to a new one...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fixed the dereferencing of a null pointer in hcisyncconnCompleteEvt. This event is only specified for SCO and eSCO link types. Upon receiving a HCISynchronousConnectionComplete event for a BDADDR of an existing LE...

PT-2026-91317

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix accept list UAF during suspend hci update event filter sync walks hdev-accept list while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-req lock, but...

EUVD-2026-67427

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

PT-2026-86700

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci connect acl/le sync callbacks There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that...

PT-2026-82992

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF condition exists in the Bluetooth component. This occurs when the conn object is freed while the hci sync task is still running. The issue is specifically related to...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Use RCU for hciconnparams and iterate safely in hcisync. hciupdateacceptlistsync iterates over hdev-pendleconns and hdev-pendlereports, and waits for controller events within the loop body, without holding the hdev...

UBUNTU-CVE-2026-74531

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

PT-2026-72981

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF condition exists in the Bluetooth component. This occurs when the conn object is freed while the hci sync task is still running, specifically within the hci connect ...

PT-2026-72980

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci past sync callback Avoids giving freed pointers to hci conn valid, which kmalloc may have reused. Hold refcount to avoid that...

CVE-2026-68393

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

CVE-2026-68390

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold hdev-lock for hciconnparams lookups hciconnparamslookup requires hdev-lock be held, otherwise the list iteration or param access is not safe. Hold hdev-lock for params lookups in hcisync...

CVE-2026-68189

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68393

The CVE-2026-68393 entry concerns the Linux kernel Bluetooth hci_sync component. The root cause is the use of RCU-protected pointers outside their critical sections without proper reference counting, which could lead to a Use-After-Free (UAF). The fix extends the critical section to cover both th...

CVE-2026-68189

CVE-2026-68189 affects the Linux kernel Bluetooth hci_sync component. A race between asynchronous command sync work and UUID list updates can cause a use-after-free in eir_create due to non-serialized access to hdev->uuids. The fix/mitigation is to hold hdev->lock while generating and commi...

PT-2026-69589

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth component due to improper synchronization during UUID list traversal. The hci sync conversion moved class-of-device and EIR generation to...

PT-2026-69790

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the hci sync function fails to hold the hdev-lock during hci conn params lookups. This lack of locking makes list iteration or parameter...

CVE-2026-63974

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close Since hcidevclosesync can now be called during the reset path, we should also set HCICMDDRAINWORKQUEUE. This avoids queuing timeouts while the hdev workqueue is bei...

CVE-2026-63974 Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close Since hcidevclosesync can now be called during the reset path, we should also set HCICMDDRAINWORKQUEUE. This avoids queuing timeouts while the hdev workqueue is bei...