EUVD-2026-48948

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in isoconnbigsync isoconnbigsync drops the socket lock to call hcigetroute and then re-acquires it, but dereferences isopisk-conn-hcon afterwards without re-checking that conn is still...

USN-8421-1 ironic vulnerabilities

Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate file paths when handling ISO images. A privileged authenticated remote user could use this issue to perform path traversal via a crafted ISO image and overwrite arbitrary files on the Ironic conductor...

CVE-2023-54038

The CVE-2023-54038 issue affects the Linux kernel Bluetooth HCI path. The root cause is that hci_connect_sco() (and similarly hci_connect_cis()) returned NULL on error, causing sco_conn_add() to dereference hcon->hdev and crash. The fix switches to returning an ERR_PTR on error for both hci_co...

CVE-2023-53673

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: call disconnect callback before deleting conn In hcicsdisconnect, we do hciconndel even if disconnection failed. ISO, L2CAP and SCO connections refer to the hciconn without hciconnget, so disconncfm must be...