Linux Distros Unpatched Vulnerability : CVE-2026-90087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: do not leak an hciconn when a second LE connect is rejected createleconncomplete decides whether the failed connection is still pending by comparing ...

Linux Distros Unpatched Vulnerability : CVE-2026-90255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if...

AZL-102869 CVE-2026-90255 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

CVE-2026-90255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

DEBIAN-CVE-2026-90255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

DEBIAN-CVE-2026-90093

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan-conn safely in get/setsockopt Since commit b66774b48dd9 "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref" l2capchan::conn has held reference and remains non-NULL also after the...

AZL-102389 CVE-2026-90087 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: do not leak an hciconn when a second LE connect is rejected createleconncomplete decides whether the failed connection is still pending by comparing it against hcilookupleconnect, which returns the first LE connection ...

CVE-2026-90255 Bluetooth: hci_conn: fix the SCO setup context lifetime

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

CVE-2026-90255 Bluetooth: hci_conn: fix the SCO setup context lifetime

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

CVE-2026-90255

CVE-2026-90255 is a Linux kernel vulnerability in the Bluetooth HCI subsystem affecting the SCO setup context lifetime. The root cause is twofold: hci_setup_sync() queues a conn_handle_t with a NULL destroy callback, causing a memory leak when the pending entry is cancelled (e.g., during controll...

EUVD-2026-81848

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

EUVD-2026-81948

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: do not leak an hciconn when a second LE connect is rejected createleconncomplete decides whether the failed connection is still pending by comparing it against hcilookupleconnect, which returns the first LE connection ...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

Linux Distros Unpatched Vulnerability : CVE-2026-89583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

CVE-2026-74531

A flaw was found in the Bluetooth hciconn component of the Linux kernel. A theoretical Use-After-Free UAF vulnerability exists if a connection conn is prematurely freed while the hcisync task is still active. This could potentially allow an attacker to cause a system crash or execute arbitrary co...

SUSE CVE-2026-74531

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...