CVE-2026-31499

A flaw was found in the Linux kernel's Bluetooth L2CAP component. A deadlock can occur in the l2capconndel function when canceling delayed work, specifically infotimer and idaddrtimer. This happens because l2capconndel holds a lock while attempting to cancel work functions that also acquire the...

CVE-2026-31393

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate L2CAPINFORSP payload length before access l2capinformationrsp checks that cmdlen covers the fixed l2capinforsp header type + result, 4 bytes but then reads rsp-data without verifying that the payload is...

CVE-2025-39863

CVE-2025-39863 affects the Linux kernel’s wifi/brcmfmac path, specifically a use-after-free in brcmf_btcoex_info handling. The vulnerability arises from a race between brcmf_btcoex_detach() and brcmf_btcoex_timerfunc(): the timer handler can set timer_on to false while a detach is in progress, ca...