EUVD-2026-59727

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel isochandel isoconnholdunlesszero isoconnlock isoconnlock conn-sk = NULL...

CVE-2026-74534 Bluetooth: ISO: fix refcounting of iso_conn

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel isochandel isoconnholdunlesszero isoconnlock isoconnlock conn-sk = NULL...

CVE-2026-72334

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

UBUNTU-CVE-2026-72334

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

CVE-2026-72334

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

CVE-2026-72124

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

EUVD-2026-59233

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

CVE-2026-72334 Bluetooth: ISO: fix malformed ISO_END/CONT handling

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

PT-2026-72993

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear iso data always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-iso data = NULL is necessary, otherwise later iso conn free will UAF. Fix clearing of iso data in iso sock disconn...

Linux Distros Unpatched Vulnerability : CVE-2026-74537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: hold sk properly in isoconnready sk deref in isoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close...

PT-2026-72990

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso connect ind Accessing iso pisk-conn requires lock sock, which is not taken in the "ev3" part of iso connect ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states...

PT-2026-72986

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso conn iso conn del and iso chan del have a race that results to double-put of iso conn: Task hdev-workqueue Task 2 iso conn del iso chan del iso conn hold unless zero iso conn lock iso conn...

PT-2026-72987

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso sock timeout iso sock timeout takes lock sock, so sync disabling the timer while holding that lock may deadlock. iso sock timeout may also run concurrently with iso conn del, which leads to...

Linux Distros Unpatched Vulnerability : CVE-2026-74535

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: avoid deadlocks in isosocktimeout isosocktimeout takes locksock, so sync disabling the timer while holding that lock may deadlock. isosocktimeou...

PT-2026-72991

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso sock getname Accessing iso pisk-conn requires lock sock, which is not held here. Fix by adding the lock/release...

Linux Distros Unpatched Vulnerability : CVE-2026-74534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix refcounting of isoconn isoconndel and isochandel have a race that results to double-put of isoconn: Task hdev-workqueue Task 2 isoconndel...

PT-2026-72988

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release iso sock kill tests !sock flagsk, SOCK ZAPPED || sk-sk socket || sock flagsk, SOCK DEAD for early return, but this is always true since sock orphansk sets SOCK DEAD, so the sk...

Linux Distros Unpatched Vulnerability : CVE-2026-72334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject...

PT-2026-72985

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref get unless zero hci conn::iso data is accessed and modified without lock or RCU. This leads to a race Task hdev-workqueue Task 2 iso recv iso conn putconn conn = LOAD hcon-iso data iso co...

Linux Distros Unpatched Vulnerability : CVE-2026-74541

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: clear isodata always when detaching conn from hcon When setting conn-hcon = NULL, also conn-hcon-isodata = NULL is necessary, otherwise later...