PT-2026-72961

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue exists in the Bluetooth subsystem. The function hci find adv instance returns an adv info pointer that is only valid while hdev-lock is held. However,...

PT-2026-72738

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Fix UAF in hci unregister dev hci unregister dev does not disable cmd timer and ncmd timer before the hci dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed...

PT-2026-72740

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci qca: fix NULL pointer dereference in qca setup for non-serdev device hu-serdev is NULL for hci uart attached via non-serdev paths, but qca setup unconditionally calls serdev device get drvdatahu-serdev and...

PT-2026-72523

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci add adv monitor publishes a new adv monitor in hdev-adv monitors idr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

PT-2026-72736

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci read codec...

CVE-2026-68389

A flaw was found in the Bluetooth Host Controller Interface HCI Qualcomm Atheros QCA driver within the Linux kernel. This vulnerability occurs when the controller reports an invalid zero memory dump size, leading to improper state cleanup. An attacker could potentially exploit this to cause memor...

2026-08 Cumulative security Hotpatch for Azure Stack HCI, version 21H2 and Windows Server 2022 Datacenter: Azure Edition for x64-based Systems (KB5120229)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information...

CVE-2026-68085

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. This vulnerability occurs when a Bluetooth device is reopened after a pending write operation was canceled, but an internal flag indicating a pending write is no...

CVE-2026-11894

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11893

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

CVE-2026-11894

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11894 Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11894

The CVE-2026-11894 entry concerns Realtek’s BEE Bluetooth HCI driver (bt_hci_bee_send in drivers/bluetooth/hci/hci_bee.c). The vulnerability arises from violating the bt_hci_driver_api buffer-ownership contract: on error, the host should retain and unref the transmit net_buf, but the pre-fix code...

EUVD-2026-55937

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11894 Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11893

The CVE concerns Bouffalo Lab on‑chip BLE controllers (BL60x/BL70x/BL61x) with Zephyr’s Bluetooth HCI, where bt_bflb_send() in hci_bflb.c violates the bt_hci_driver_api.send() buffer-ownership contract. On error, the driver unrefs the buffer, but the host TX path (send_buf() in subsys/bluetooth/h...

CVE-2026-11893

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

EUVD-2026-55935

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

CVE-2026-11893 Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

KB5120242: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (August 2026)

The remote Windows host is missing security update 5120242 or hotpatch 5120229. It is, therefore, affected by multiple vulnerabilities - Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. CVE-2026-62815 - Stack-based buffer overflow in Windows DNS...