Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: validate rx pkttype header length virtbtrxhandle reads the leading pkttype byte from the RX skb and forwards the remainder to hcirecvframe for every event/ACL/SCO/ISO type, without checking that the remaining...

wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

...

net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

...

CVE-2026-64351

In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmiarxfixup kalmiarxfixup computes usbpacketlength = skb-len - 2 KALMIAHEADERLENGTH as a u16, guarded only by a pre-loop check that skb-len is at least KALMIAHEADERLENGTH, which is 6. ...

CVE-2026-63946

CVE-2026-63946: In the Linux kernel Bluetooth ISO path, iso_recv_frame can use a freed sk due to holding iso_conn_lock but releasing it before using conn->sk. The fix replaces a bare pointer read with iso_sock_hold(conn), which holds the sock while the spinlock is still held and atomically inc...

SUSE CVE-2026-46186

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: validate rx pkttype header length virtbtrxhandle reads the leading pkttype byte from the RX skb and forwards the remainder to hcirecvframe for every event/ACL/SCO/ISO type, without checking that the remaining...

CVE-2026-46186

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: validate rx pkttype header length virtbtrxhandle reads the leading pkttype byte from the RX skb and forwards the remainder to hcirecvframe for every event/ACL/SCO/ISO type, without checking that the remaining...

CVE-2026-46186 Bluetooth: virtio_bt: validate rx pkt_type header length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: validate rx pkttype header length virtbtrxhandle reads the leading pkttype byte from the RX skb and forwards the remainder to hcirecvframe for every event/ACL/SCO/ISO type, without checking that the remaining...

EUVD-2026-32813

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: validate rx pkttype header length virtbtrxhandle reads the leading pkttype byte from the RX skb and forwards the remainder to hcirecvframe for every event/ACL/SCO/ISO type, without checking that the remaining...

Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

...

CVE-2026-31408 Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in scorecvframe due to missing sockhold scorecvframe reads conn-sk under scoconnlock but immediately releases the lock without holding a reference to the socket. A concurrent close can free the...

CVE-2026-31408

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in scorecvframe due to missing sockhold scorecvframe reads conn-sk under scoconnlock but immediately releases the lock without holding a reference to the socket. A concurrent close can free the...

Linux Distros Unpatched Vulnerability : CVE-2026-31408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: SCO: Fix use-after-free in scorecvframe due to missing sockhold scorecvframe reads conn-sk under scoconnlock but immediately releases the lock withou...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993137)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993137 advisory. In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix skb leak in x25lapbreceiveframe x25lapbreceiveframe using skbcopy to get a private...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990768)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990768 advisory. In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix skb leak in x25lapbreceiveframe x25lapbreceiveframe using skbcopy to get a private...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986637)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986637 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: rfcomm: Fix null-ptr-deref in rfcommchecksecurity During our fuzz testing of the...

DEBIAN-CVE-2024-26903

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: rfcomm: Fix null-ptr-deref in rfcommchecksecurity During our fuzz testing of the connection and disconnection process at the RFCOMM layer, we discovered this bug. By comparing the packets from a normal connection and...

PT-2022-35986

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.10 Description The issue is related to a potential security problem in the net/x25 component, specifically in the x25 lapb receive frame function, where a skb leak may occur. The actual impact and attack...

PT-2022-36399

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.225 Description The issue is related to a potential security problem in the net/x25 component, specifically in the x25 lapb receive frame function, where a skb leak is fixed. The actual impact and attack...

PT-2022-36544

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.300 Description The issue is related to a potential security problem in the net/x25 component, specifically in the x25 lapb receive frame function, where a skb leak is fixed. The actual impact and attack...