Linux Distros Unpatched Vulnerability : CVE-2026-98600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifie...

CVE-2026-77684 Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service

The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfphf.c does not release the AT command buffers that are still queued on hf-txpending when the RFCOMM DLC goes down. hfphfdisconnected only cancelled the work items and cleared hf-acl, and no other code path ever...

CVE-2026-77684 Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service

The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfphf.c does not release the AT command buffers that are still queued on hf-txpending when the RFCOMM DLC goes down. hfphfdisconnected only cancelled the work items and cleared hf-acl, and no other code path ever...

CVE-2026-77684

The Bluetooth Classic Hands-Free Profile (HFP) HF role in Zephyr RTOS (subsys/bluetooth/host/classic/hfp_hf.c) contains a memory leak where AT command buffers are not released when the RFCOMM DLC goes down. This causes a permanent leak from the fixed hf_pool . If the pool is exhausted, subsequent...

CVE-2026-98455

A flaw was found in the Linux kernel's Bluetooth Radio Frequency Communication RFCOMM subsystem. This vulnerability allows a local user to cause a Denial of Service DoS by crashing the system. By querying connection options on a socket whose connection was disconnected while deferred setup remain...

CVE-2026-98600

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...

UBUNTU-CVE-2026-98600

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...

UBUNTU-CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

Linux Distros Unpatched Vulnerability : CVE-2026-98455

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long a...

CVE-2026-98739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...

UBUNTU-CVE-2026-98739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...

SUSE CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

SUSE CVE-2026-98600

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...

DEBIAN-CVE-2026-98600

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...

DEBIAN-CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

AZL-108653 CVE-2026-98739 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...

DEBIAN-CVE-2026-98739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...

CVE-2026-98739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...

CVE-2026-98600

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...