CVE-2026-98246

A use-after-free vulnerability exists in the Linux kernel Bluetooth stack within the hci_sync component. The hci_dev_close_sync() function clears the hdev->local_codecs list after releasing the hdev->lock, whereas additions and traversals in sco_sock_getsockopt() correctly acquire this lock...

EUVD-2026-93174

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Serialize local codec list cleanup hcidevclosesync clears hdev-localcodecs after releasing hdev-lock. Codec list additions and both traversals in scosockgetsockopt use that lock, but the close path does not. A...

CVE-2020-35499: NULL Pointer Dereference

A NULL pointer dereference flaw in Linux kernel versions prior to 5.11 may be seen if scosockgetsockopt function in net/bluetooth/sco.c do not have a sanity check for a socket connection, when using BTSNDMTU/BTRCVMTU for SCO sockets. This could allow a local attacker with a special user privilege...

CVE-2020-35499

A NULL pointer dereference flaw may be seen if scosockgetsockopt function in net/bluetooth/sco.c do not have a sanity check for a socket connection, when using BTSNDMTU/BTRCVMTU for SCO sockets. This could allow a local attacker with a special user privilege to crash the system DOS or leak kernel...

CentOS Update for kernel CESA-2011:0833 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...