EUVD-2026-93283

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

CVE-2026-98298 dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

CVE-2026-98298

The Linux kernel contains a vulnerability in the dmaengine component, specifically within the mmp_pdma driver. The root cause is an error in the mmp_pdma_prep_slave_sg() function where for_each_sg() incorrectly retrieves the entry length from the list head (sgl) instead of the current entry (sg)....

CVE-2026-98296

A vulnerability exists in the Linux kernel 's Bluetooth btintel_pcie driver. The function btintel_pcie_prepare_tx() performs an unchecked memcpy to copy skb->len bytes into a fixed DMA slot of 4096 bytes. While oversized packets are currently rejected in btintel_pcie_send_frame(), any future c...

CVE-2026-98296 Bluetooth: btintel_pcie: validate TX skb length in send_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...

CVE-2026-98297 Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix queuing txwork after workqueue is drained hcisendacl, hcisendsco and hcisendiso queue hdev-txwork unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hcidevclosesync is draining...

EUVD-2026-93281

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...

EUVD-2026-93282

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix queuing txwork after workqueue is drained hcisendacl, hcisendsco and hcisendiso queue hdev-txwork unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hcidevclosesync is draining...

CVE-2026-98297

A vulnerability exists in the Linux kernel Bluetooth hci_core component where functions hci_send_acl(), hci_send_sco(), and hci_send_iso() unconditionally queue hdev->tx_work. This creates a race condition during hci_dev_close_sync() while draining the hdev->workqueue (triggered by HCIDEVDO...

CVE-2026-98296 Bluetooth: btintel_pcie: validate TX skb length in send_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...

CVE-2026-98297 Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix queuing txwork after workqueue is drained hcisendacl, hcisendsco and hcisendiso queue hdev-txwork unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hcidevclosesync is draining...

CVE-2026-98295

The Linux kernel contains a vulnerability in the Bluetooth subsystem related to coredump processing. The function hci_devcd_handle_pkt_init() incorrectly arms dump_timeout and coredump producers without holding an hdev reference . This allows these works to remain live during unregistration, pote...

EUVD-2026-93280

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hcidevcdhandlepktinit arms dumptimeout and coredump producers queue dumprx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an acti...

CVE-2026-98295 Bluetooth: coredump: Quiesce dump work on unregister

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hcidevcdhandlepktinit arms dumptimeout and coredump producers queue dumprx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an acti...

CVE-2026-98295 Bluetooth: coredump: Quiesce dump work on unregister

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hcidevcdhandlepktinit arms dumptimeout and coredump producers queue dumprx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an acti...

CVE-2026-98294 Bluetooth: hci_qca: Do not write to the serial port after it is closed

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Do not write to the serial port after it is closed hciuartclose closes the serdev port if HCIQUIRKNONPERSISTENTSETUP is set for example, for the WCN399x family. A failed hcidevopensync following a successful...

EUVD-2026-93222

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Do not write to the serial port after it is closed hciuartclose closes the serdev port if HCIQUIRKNONPERSISTENTSETUP is set for example, for the WCN399x family. A failed hcidevopensync following a successful...

CVE-2026-98294

The Linux kernel contains a vulnerability in the hci_qca driver where the system attempts to write to a serial port after it has been closed. Specifically, if HCI_QUIRK_NON_PERSISTENT_SETUP is set (e.g., for the WCN399x family), a failed hci_dev_open_sync() after a successful qca_setup() leads to...

CVE-2026-98294 Bluetooth: hci_qca: Do not write to the serial port after it is closed

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Do not write to the serial port after it is closed hciuartclose closes the serdev port if HCIQUIRKNONPERSISTENTSETUP is set for example, for the WCN399x family. A failed hcidevopensync following a successful...

EUVD-2026-93221

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in isoconnready isogetsock returns the parent socket with a reference held, which is dropped by sockput once the child socket has been set up. The error path taken when isosockalloc fails on...