PT-2026-98640

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the btintel pcie submit rx work function reads the packet len variable from rfh hdr without verifying if it exceeds the RX buffer size. A...

PT-2026-98641

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth btusb module. The functions btusb close and btusb flush use the asynchronous cancel delayed work to cancel data-rx work. If btusb rx wo...

PT-2026-96435

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtio vsock remove stops the virtqueues and then flushes each work item before freeing the enclosing virtio vsock. The current order does not account for dependencies between those...

PT-2026-69811

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mac80211 hwsim component where the hwsim virtio rx work function passes the virtqueue used-ring length reported by the device directly to skb put on a fixed-size...

CVE-2026-64206 Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pendingrxwork before taking conn-lock l2capconndel takes conn-lock and then calls cancelworksync for pendingrxwork. processpendingrx takes the same mutex, so teardown can deadlock against the worker it is...

CVE-2026-64206

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pendingrxwork before taking conn-lock l2capconndel takes conn-lock and then calls cancelworksync for pendingrxwork. processpendingrx takes the same mutex, so teardown can deadlock against the worker it is...

CVE-2026-46123

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: clamp rx length before skbput virtbtrxwork calls skbputskb, len where len comes directly from virtqueuegetbuf with no validation against the buffer we posted to the device. The RX skb is allocated in...

SUSE CVE-2026-31509

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix circular locking dependency in nciclosedevice nciclosedevice flushes rxwq and txwq while holding reqlock. This causes a circular locking dependency because ncirxwork running on rxwq can end up taking reqlock too:...

CVE-2026-31509 nfc: nci: fix circular locking dependency in nci_close_device

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix circular locking dependency in nciclosedevice nciclosedevice flushes rxwq and txwq while holding reqlock. This causes a circular locking dependency because ncirxwork running on rxwq can end up taking reqlock too:...

CVE-2026-31509 nfc: nci: fix circular locking dependency in nci_close_device

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix circular locking dependency in nciclosedevice nciclosedevice flushes rxwq and txwq while holding reqlock. This causes a circular locking dependency because ncirxwork running on rxwq can end up taking reqlock too:...

CVE-2026-23393

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peermep deletion When a peer MEP is being deleted, canceldelayedworksync is called on ccmrxdwork before freeing. However, brcfmframerx runs in softirq context under rcureadlock without RTNL and...

OESA-2025-2802 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in ncirxwork syzbot reported the following uninit-value access issue 1 ncirxwork parses received packet from ndev-rxq. It should be...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986342)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986342 advisory. In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in ncirxwork syzbot reported the following uninit-value access issue 1...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfc: nci: Fixed an uninit-value issue in ncirxwork. syzbot reported the following uninit-value access issue 1. ncirxwork parses the received packet from ndev-rxq. It is necessary to validate the header size, payload size, and...

CVE-2024-46760

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: schedule rx work after everything is set up Right now it's possible to hit NULL pointer dereference in rtwrxfillrxstatus on hw object and/or its fields because initialization routine can start getting USB replie...

CVE-2024-46760 wifi: rtw88: usb: schedule rx work after everything is set up

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: schedule rx work after everything is set up Right now it's possible to hit NULL pointer dereference in rtwrxfillrxstatus on hw object and/or its fields because initialization routine can start getting USB replie...

AZL-48945 CVE-2024-38381 affecting package kernel for versions less than 5.15.162.2-1

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in ncirxwork syzbot reported the following uninit-value access issue 1 ncirxwork parses received packet from ndev-rxq. It should be validated header size, payload size and total packet size before...

PT-2024-7074

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the nci rx work function in the Linux kernel's NFC module, which parses received packets from ndev-rx q. The function should validate the header size, payload siz...

DEBIAN-CVE-2024-26886

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: afbluetooth: Fix deadlock Attemting to do socklock on .recvmsg may cause a deadlock as shown bellow, so instead of using socksock this uses skreceivequeue.lock on btsockioctl to avoid the UAF: INFO: task kworker/u9:1:1...

PT-2024-8414

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the use of an uninitialized resource in the nci rx work function. When the payload length is zero, each message type handler reads uninitialized payload, and KMSA...