DEBIAN-CVE-2026-99009

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

DEBIAN-CVE-2026-99011

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

CVE-2026-99009

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

CVE-2026-99009

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

UBUNTU-CVE-2026-99009

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

CVE-2026-99011

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

CVE-2026-99011 Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

EUVD-2026-108805

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

CVE-2026-99009 Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

CVE-2026-99009

The Linux kernel contains a circular locking dependency vulnerability in the Bluetooth RFCOMM component. The issue arises because an RFCOMM connect() from userspace acquires rfcomm_mutex before hdev->lock, while the HCI event path (via rfcomm_security_cfm()) acquires them in the opposite order...

EUVD-2026-108803

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

CVE-2026-99009 Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

PT-2026-121986

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm mutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

PT-2026-121988

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise sco conn lifetime against sco recv scodata sco recv scodata upgrades the weak hcon-sco data back-pointer to a strong reference under hdev-lock: hci dev lockhdev; hcon = hci conn hash lookup handlehdev,...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions from 5.10.270 up to and including 5.11, from 5.15.221 up to and including 5.16, from 6.1.188 up to and including 6.2, from 6.6.157 up to and including 6.6.160, from 6.12.109 up to and including 6.12.114, from 6.18.50 up to and including...

Linux Distros Unpatched Vulnerability : CVE-2026-99009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a...

PT-2026-116956

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix inquiry cache use-after-free The sync command worker holds hdev-req lock, but inquiry-cache updates and flushes use hdev-lock. Both hci acl create conn sync and hci stop discovery sync look up entries and...

PT-2026-91343

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci event: fix LE list UAF on reset hci cc reset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs reade...

PT-2026-85605

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue exists in the Bluetooth component where the hci cc reset function clears the Low Energy LE accept and resolving lists without acquiring the hdev-lock. This lac...

SUSE CVE-2026-72336

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control getl2capconn looks up an LE hciconn under hdev protection, but then drops that protection before reading hcon-l2capdata and before lowpancontrolwrite later dereferences...