DEBIAN-CVE-2026-99011

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

CVE-2026-99011

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

EUVD-2026-108805

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

CVE-2026-99011

The Linux kernel is affected by a slab-use-after-free vulnerability in the Bluetooth SCO component. The issue arises because sco_recv_scodata() upgrades a weak back-pointer to a strong reference under hdev->lock, but the pointer is cleared by sco_conn_free() without holding that same lock. Thi...

CVE-2026-99011 Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

CVE-2026-99011 Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

CVE-2026-99011

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

Linux Distros Unpatched Vulnerability : CVE-2026-106589

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related...

UBUNTU-CVE-2026-98736

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Lock parent access during enhanced SCO setup Bluetooth: hciconn: Lock parent access during enhanced SCO setup hcienhancedsetupsync runs on the request workqueue without the hcidevlock held by its caller when...

CVE-2026-98459

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hcibindbis hciconnlink takes a lifetime reference to its parent with hciconnget, but only takes an operational hold on the child. hciconnunlink later balances both a hold and a reference...

CVE-2026-98736

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Lock parent access during enhanced SCO setup Bluetooth: hciconn: Lock parent access during enhanced SCO setup hcienhancedsetupsync runs on the request workqueue without the hcidevlock held by its caller when...

CVE-2026-98734

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize SCO and ISO scheduling with teardown hcilowsent selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used...

CLSA-2023-1683146027 kernel: Fix of 24 CVEs

media: rc: Fix use-after-free bugs caused by enetxirqsim CVE-2023-1118 - net: mpls: fix stale pointer if allocation fails during device rename CVE-2023-26545 - net/ulp: prevent ULP without clone op from entering the LISTEN status CVE-2023-0461 - Bluetooth: L2CAP: Fix u8 overflow CVE-2022-45934 -...

CLSA-2026-1777614769 kernel: Fix of 18 CVEs

crypto: algifaead - Fix minimum RX size check for decryption - crypto: afalg - Fix page reassignment overflow in afalgpulltsgl - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authenc - use...

PT-2026-116953

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Serialize SCO and ISO scheduling with teardown hci low sent selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used...

PT-2026-116955

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: Lock parent access during enhanced SCO setup Bluetooth: hci conn: Lock parent access during enhanced SCO setup hci enhanced setup sync runs on the request workqueue without the hci dev lock held by its caller...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.1 contains security vulnerabilities. These vulnerabilities arise from the lack of holding of hcidevlock during the enhanced SCO setup process. The CVSD capability check and the operation of findnextescoparam that dereferences conn-parent and releases the parent object o...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Fixed issues with dangling scoconn objects and use-after-free in scosocktimeout. Consecutively connecting the same socket twice in scosockconnect could lead to a race condition, where two scoconn objects are created...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Race conditions in scosockconnect have been fixed. scosockconnect checks skstate and sktype without holding the socket lock. Two concurrent connect system calls on the same socket can both pass the check and enter...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: call disconnect callback before deleting conn In hcicsdisconnect, we do hciconndel even if disconnection failed. ISO, L2CAP and SCO connections refer to the hciconn without hciconnget, so disconncfm must be...