225 matches found
CVE-2026-93098
A flaw was found in the Linux kernel. A deadlock can occur in the rpmsg: glink component during driver detachment. This issue arises when a redundant device unregistration attempts to acquire a mutex that is already held, causing the system to hang indefinitely. This can lead to a Denial of Servi...
Astra Linux – vulnerability in linux-5.15
The rpmsgprobe function in drivers/rpmsg/virtiorpmsgbus.c within the Linux kernel prior to version 5.18.4 contains a double free vulnerability...
Astra Linux – Vulnerability in Linux 5.15
The function rpmsgvirtioaddctrldev in the file drivers/rpmsg/virtiorpmsgbus.c in the Linux kernel, prior to version 5.18.4, contains a double-free...
EUVD-2026-97104
The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...
PT-2026-110218
The zbus proxy agent IPC backend in subsys/zbus/proxy agent/zbus proxy agent ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus proxy msg carries a fixed-size channel name array as its last member, and nothing in the transport...
ROS-20261009-73-0068
The vulnerability of the rpmsg/rpmsgcore.c component in the Linux operating system is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...
SUSE CVE-2026-97908
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...
CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2025:1763734783)
The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2025:1763734783 advisory. - In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use-after-free warning Fix the following...
AZL-104394 CVE-2026-97908 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...
DEBIAN-CVE-2026-97908
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...
CVE-2026-97908
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...
UBUNTU-CVE-2026-97908
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...
CVE-2026-97908 Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...
EUVD-2026-86762
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...
CVE-2026-97908 Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...
CVE-2026-97908
The Linux kernel contains a vulnerability in the btqcomsmd Bluetooth driver where RPMsg endpoints are destroyed after the hci_dev is freed. Because receive callbacks dereference btq->hdev without taking a reference, a window exists where WCNSS data delivery can cause the callback to run with a...
CVE-2026-97908
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...
CVE-2026-97908
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...
CVE-2026-97908: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...
PT-2026-98572
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth btqcomsmd component where the teardown order is incorrect. The command and ACL RPMsg endpoints store struct btqcomsmd as callback private data, and recei...