CVE-2026-68391

A flaw was found in the Linux kernel's Bluetooth management component. This vulnerability involves a Use-After-Free UAF condition, a type of memory corruption where the system attempts to use memory after it has been freed. This can occur due to improper handling of hciconn pointers, potentially...

CVE-2026-68391

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

CVE-2026-64405

A flaw was found in the Linux kernel's Bluetooth subsystem, specifically within the hciconn module. This vulnerability occurs when the hciabortconn function attempts to process a pending connection while a critical pointer is unexpectedly null. This can lead to a null pointer dereference, causing...

Oracle Linux 8 : kernel (ELSA-2026-2720)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2720 advisory. - Bluetooth: hcievent: Fix checking conn for leconncompleteevt David Marlin RHEL-137111 CVE-2023-53762 - Bluetooth: hcisync: Fix UAF in...

AZL-68276 CVE-2024-56591 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Use disabledelayedworksync This makes use of disabledelayedworksync instead canceldelayedworksync as it not only cancel the ongoing work but also disables new submit which is disarable since the object holding...

CVE-2024-56591

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Use disabledelayedworksync This makes use of disabledelayedworksync instead canceldelayedworksync as it not only cancel the ongoing work but also disables new submit which is disarable since the object holding...

CVE-2024-50029 Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix UAF in hcienhancedsetupsync This checks if the ACL connection remains valid as it could be destroyed while hcienhancedsetupsync is pending on cmdsync leading to the following trace: BUG: KASAN:...

CVE-2024-50029 Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix UAF in hcienhancedsetupsync This checks if the ACL connection remains valid as it could be destroyed while hcienhancedsetupsync is pending on cmdsync leading to the following trace: BUG: KASAN:...

CVE-2024-36968

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix div-by-zero in l2capleflowctlinit l2capleflowctlinit can cause both div-by-zero and an integer overflow since hdev-lemtu may not fall in the valid range. Move MTU from hcidev to hciconn to validate MTU and...

CVE-2024-36968 Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix div-by-zero in l2capleflowctlinit l2capleflowctlinit can cause both div-by-zero and an integer overflow since hdev-lemtu may not fall in the valid range. Move MTU from hcidev to hciconn to validate MTU and...

CVE-2024-36968

The CVE-2024-36968 entry concerns the Linux kernel Bluetooth L2CAP path. Concrete details across connected docs show: the vulnerability arises in l2cap_le_flowctl_init() where MTU validation could fail, allowing division by zero and an integer overflow when hdev->le_mtu is out of the valid ran...

GSD-2023-1001932 Bluetooth: hci_conn: Fix memory leaks

Bluetooth: hciconn: Fix memory leaks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.9 by commit f51a825b9f730a782aa768454906b4468e67b667, ...