CVE-2026-19940 Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...

CVE-2026-19940

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c is vulnerable to a memory corruption issue. When a link is torn down, the hfp_ag_disconnected() function fails to cancel the ag->ongoing_call_work item. If a new connection reuses th...

CVE-2026-19940 Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...

CVE-2026-19940

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...

CVE-2026-19939

The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...

CVE-2026-19939 Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption

The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...

Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2024-53161 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM...

kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership()

A flaw was found in the Linux kernel's iouring/poll component. A logic error exists in the iopollgetownership function due to an incorrect signed comparison. This flaw prevents the necessary slowpath from being triggered when the IOPOLLCANCELFLAG is set, potentially leading to unexpected behavior...

kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

A flaw was found in the Linux kernel's RDMA/mlx5 component. An error path fall-through in the mlx5ibdevressrqinit function, specifically when ibcreatesrq fails, can lead to the use of freed memory and error pointers. This memory corruption vulnerability could result in system instability, denial ...

Important: Red Hat Security Advisory: kpatch-patch-6_12_0-211_16_1 and kpatch-patch-6_12_0-211_49_1 security update

An update for kpatch-patch-6120-211161 and kpatch-patch-6120-211491 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

ghostlock-k419-adapter

GhostLock — OnePlus Locked Bootloader Jailbreak Kernel exploit for OnePlus/OPPO/realme devices with locked bootloader. Achieves root + KernelSU installation without unlocking bootloader or modifying boot image. Runtime auto-detection of kernel version with multi-device offset table. Vulnerability...

USN-8924-1 linux vulnerabilities

It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real PID value while inside a PID namespace. A local attacker could use this to expose sensitive information. CVE-2017-5967 Wen Xu discovered that the XFS file system implementation in the Linux...

USN-8924-1: Linux kernel vulnerabilities

It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real PID value while inside a PID namespace. A local attacker could use this to expose sensitive information. CVE-2017-5967 Wen Xu discovered that the XFS file system implementation in the Linux...

CVE-2026-46300

CVE-KERNEL · Linux Kernel LPE Chain Multi-CVE Local Privilege Escalation chain for Linux kernel vulnerabilities uid=1000 → root via xfrm-ESP, RxRPC, or Fragnesia page-cache write Overview CVE-KERNEL is a Python-based Local Privilege Escalation LPE tool that chains multiple Linux kernel CVEs to...

CVE-2026-90261

A flaw was found in the btrfs zoned filesystem component of the Linux kernel. During metadata-heavy operations, a specific writeback scenario can prevent the system from properly managing active block groups. This issue can lead to a transaction abortion, forcing the filesystem into a read-only...

CVE-2026-90262

A flaw was found in the Linux kernel's btrfs filesystem. This flaw occurs when the btrfsreadmerkletreepage function encounters a Merkle folio that is not up-to-date. Instead of retrying the read, the system incorrectly treats this as a permanent error, causing transient read failures to become...

CVE-2026-90250

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter cgroup storage mechanism. When replacing an existing BPF program with a new one that uses BPFMAPTYPEPERCPUCGROUPSTORAGE, the system may fail to properly allocate and assign the necessary cgroup storage. This oversight can lead to a...

CVE-2026-90242

A flaw was found in the Linux kernel's iommu/vt-d subsystem. When an IOMMU Input/Output Memory Management Unit domain with an iopfhandler is replaced by another domain at the Requestor ID RID level, a reference count for the old domain is not properly released. This resource leak prevents the...

CVE-2026-90238

A flaw was found in the Linux kernel's AMD ISP4 media driver. During the initialization process, a self-deadlock can occur if the isp4sdpwronandinit function attempts to re-acquire a mutex it already holds. This issue can lead to a system deadlock, resulting in a Denial of Service DoS for the...