SUSE CVE-2026-68394

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

CVE-2026-68394

In CVE-2026-68394, the Linux kernel Bluetooth MGMT path had a use-after-free in conn_update_sync triggered by MGMT_OP_LOAD_CONN_PARAM queuing a param update. The queued work incorrectly kept a borrowed hci_conn_params pointer; if userspace freed the entry before the callback ran, a use-after-free...

PT-2026-69790

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the hci sync function fails to hold the hdev-lock during hci conn params lookups. This lack of locking makes list iteration or parameter...

CVE-2026-64433

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete adddevicecomplete runs from the hcicmdsyncwork kworker, which holds only hcireqsynclock and not hcidevlock. It calls hciconnparamslookup and then dereferences the...

Linux Distros Unpatched Vulnerability : CVE-2026-64433

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete adddevicecomplete runs from the hcicmdsyncwork kworker, which holds only hcireqsynclock and not...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005561)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005561 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Add error handling to pairdevice hciconnparamsadd never checks for a NULL value...

CVE-2023-53252

The CVE-2023-53252 entry applies to the Linux kernel Bluetooth stack. The vulnerability arises in hci_update_accept_list_sync where hci_conn_params/hci_sync lists are iterated while the lists can be modified (e.g., by le_scan_cleanup) without holding the device lock, risking an invalid list curso...

CVE-2023-53252 Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use RCU for hciconnparams and iterate safely in hcisync hciupdateacceptlistsync iterates over hdev-pendleconns and hdev-pendlereports, and waits for controller events in the loop body, without holding hdev lock...

AZL-48197 CVE-2024-43884 affecting package kernel for versions less than 6.6.51.1-5

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Add error handling to pairdevice hciconnparamsadd never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error handling in the function...

PT-2024-30741

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.3/6.11-rc5 Description A null pointer dereference issue has been identified in the Linux kernel's Bluetooth functionality, specifically in the hci conn params add function, which does not check for a NULL value...