28730 matches found
EUVD-2026-67456
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in isoconn After isoconndel, ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel releasing the last reference to the...
CVE-2026-80721 Bluetooth: ISO: ensure no dangling hcon references in iso_conn
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in isoconn After isoconndel, ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel releasing the last reference to the...
CVE-2026-80692
CVE-2026-80692 is a theoretical Use-After-Free (UAF) in the Linux kernel's Bluetooth HCI subsystem , specifically in the hci_connect_acl() and hci_connect_le_sync() callbacks. If the conn object is freed while the hci_sync task is running, a UAF can occur. The fix holds a refcount to the conn obj...
CVE-2026-80692
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...
CVE-2026-80683
CVE-2026-80683 is a use-after-free vulnerability in the Linux kernel's Bluetooth SCO subsystem . The root cause is a reference-counting bug: the SCO socket stores a sco_conn pointer without holding its own reference. When a socket close() races the Bluetooth controller's Disconnection Complete ev...
CVE-2026-80683
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...
CVE-2026-80642 liveupdate: Reference count incoming FLB data
In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...
CVE-2026-80642
CVE-2026-80642 affects the Linux kernel 's liveupdate subsystem. During a Live Update, a subsystem may need to hold incoming File-Lifecycle-Bound (FLB) data for an extended period (e.g., during device enumeration). The vulnerability stems from a missing reference count on the incoming FLB structu...
EUVD-2026-67518
In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...
CVE-2026-80642 liveupdate: Reference count incoming FLB data
In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...
CVE-2026-80642
In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...
CVE-2026-80618
CVE-2026-80618 affects the Linux kernel's amdkfd (AMD GPU driver) component. The root cause is a double-unpin of DOORBELL and MMIO remap buffer objects (BOs): amdgpu_amdkfd_gpuvm_free_memory_of_gpu() unpinned the BOs before checking whether the BO was still mapped to the GPU. When the BO remained...
CVE-2026-80619
CVE-2026-80619 is a Use-After-Free (UAF) in the Linux kernel's AppArmor subsystem. The function aa_replace_profiles accessed udata->size after calling aa_put_loaddata(udata), which drops the reference to the load data structure. The fix saves the size into a local variable before releasing the...
SUSE CVE-2026-72179
In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populatecacheleaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final ofnodeputnp correctly drops the...
SUSE CVE-2026-72214
In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmemdeviceput causing reference leak In cpcapbatterydetectbatterytype, the reference to an nvmem device obtained via nvmemdevicefind is not released with nvmemdeviceput on the success or...
SUSE CVE-2026-72240
In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platformdeviceregister fails in sm501registerdevice, the embedded struct device in pdev has already been initialized by deviceinitialize, but the failure path only...
SUSE CVE-2026-72245
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1xdeviceparsedt error path After deviceinitialize, the embedded struct device in struct host1xdevice should be released through the device core with putdevice. In host1xdeviceadd, if...
SUSE CVE-2026-72461
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the skctx Currently updateskctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the referenc...
PT-2026-83021
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where ISO sockets may dereference the hcon reference after the iso conn del function has been called. This occurs because the clearing...