CVE-2026-68390

A flaw was found in the Linux kernel's Bluetooth subsystem, specifically within the hcisync component. This vulnerability occurs because the hciconnparamslookup function does not properly hold a necessary lock hdev-lock during operations. This oversight can lead to unsafe list iterations or...

CVE-2026-68392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...

CVE-2026-68189

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68392

Summary: CVE-2026-68392 affects the Linux kernel Bluetooth management path. The vulnerability arises from dereferencing RCU-protected pointers outside critical sections during unpair_device/disconnect_sync, enabling a Use-After-Free (UAF) scenario. The fix targets the critical section handling fo...

UBUNTU-CVE-2026-64595

In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove hidgocfgprobe initialises drvdata.gocfgsetup and schedules it to run 2 ms later: INITDELAYEDWORK&drvdata.gocfgsetup, &cfgsetup; scheduledelayedwork&drvdata.gocfgsetup,...

CVE-2026-53276

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix a use-after-free of the hciconn pointer In isosockrebindbc, the bis pointer is cached, then the socket lock is dropped: bis = isopisk-conn-hcon; / Release the socket before lookups since that requires hcidevlo...

CVE-2026-53251

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix not releasing hdev reference on isoconnbigsync hcigetroute returns a reference-counted hcidev pointer via hcidevhold. The function exits normally or with an error without ever releasing it...

CVE-2026-53276 Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix a use-after-free of the hciconn pointer In isosockrebindbc, the bis pointer is cached, then the socket lock is dropped: bis = isopisk-conn-hcon; / Release the socket before lookups since that requires hcidevlo...

CVE-2026-53251 Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix not releasing hdev reference on isoconnbigsync hcigetroute returns a reference-counted hcidev pointer via hcidevhold. The function exits normally or with an error without ever releasing it...

CVE-2026-53251

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix not releasing hdev reference on isoconnbigsync hcigetroute returns a reference-counted hcidev pointer via hcidevhold. The function exits normally or with an error without ever releasing it...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hciconn: Fixed a potential Universal Arbitrary Fault UAF in setcigparamssync. The lookup of hciconn and field access must be protected by the hdev lock in setcigparamssync. Otherwise, it’s possible that these...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A use-after-free flaw was discovered in btsdioremove in the drivers\bluetooth\btsdio.c file within the Linux kernel. In this flaw, calling btsdioremove with an unfinished job may lead to a race condition, resulting in a User Account Fault UAF on HDev devices...

SUSE CVE-2026-43019

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix potential UAF in setcigparamssync hciconn lookup and field access must be covered by hdev lock in setcigparamssync, otherwise it's possible it is freed concurrently. Take hdev lock to prevent hciconn from...

CVE-2026-43119 Bluetooth: hci_sync: annotate data-races around hdev->req_status

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: annotate data-races around hdev-reqstatus hcicmdsyncsk sets hdev-reqstatus under hdev-reqlock: hdev-reqstatus = HCIREQPEND; However, several other functions read or write hdev-reqstatus without holding any loc...

CVE-2026-43119

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: annotate data-races around hdev-reqstatus hcicmdsyncsk sets hdev-reqstatus under hdev-reqlock: hdev-reqstatus = HCIREQPEND; However, several other functions read or write hdev-reqstatus without holding any loc...

PT-2026-37429

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A data race exists in the Bluetooth component involving the hdev-req status variable. While hci cmd sync sk modifies this variable under the hdev-req lock, other functions—including hci...

Linux kernel 安全漏洞

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from concurrent access to the hdev-reqstatus field without using the READONCE/WRITEONCE annotation,...

Linux Distros Unpatched Vulnerability : CVE-2026-43019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciconn: fix potential UAF in setcigparamssync hciconn lookup and field access must be covered by hdev lock in setcigparamssync, otherwise it's...

CVE-2026-43019 Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix potential UAF in setcigparamssync hciconn lookup and field access must be covered by hdev lock in setcigparamssync, otherwise it's possible it is freed concurrently. Take hdev lock to prevent hciconn from...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-007011)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007011 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrigreportversion in ntrigreportversion, hdev...