SUSE CVE-2026-63945

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-64010

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-64177 phonet/pep: disable BH around forwarded sk_receive_skb()

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded skreceiveskb The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process...

CVE-2026-64177 phonet/pep: disable BH around forwarded sk_receive_skb()

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded skreceiveskb The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process...

CVE-2026-63871

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on isopi fields in hcigetroute calls isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync call hcigetroute using isopisk-dst, isopisk-src, and isopisk-srctype without holding locksock. Thes...

CVE-2026-64010

CVE-2026-64010 involves a use-after-free in the Linux NFC LLCP stack. The race occurs when nfc_llcp_recv_cc() moves a socket from the connecting_sockets list to the sockets list without holding the socket lock, risking linking a freed socket if llcp_sock_release() runs concurrently. The mitigatio...

CVE-2026-63971 sctp: fix race between sctp_wait_for_connect and peeloff

In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the...

CVE-2026-63971 sctp: fix race between sctp_wait_for_connect and peeloff

In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the...

CVE-2026-63971

CVE-2026-63971 — Linux kernel SCTP race : The issue occurs when sctp_wait_for_connect drops and re-acquires the socket lock while waiting for an association to reach ESTABLISHED. During this window, another thread can peeloff the association to a new socket via getsockopt(SCTP_SOCKOPT_PEELOFF), c...

CVE-2026-63971

In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the...

CVE-2026-63945 Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-63945

CVE-2026-63945 affects the Linux kernel Bluetooth ISO code. The vulnerability arises when iso_sock_clear_timer() reads iso_pi(sk)->conn twice without holding the socket lock, while iso_chan_del() may NULL the connection under lock_sock, creating a window where the reference can be dropped and ...

CVE-2026-63945 Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

EUVD-2026-45718

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-63945

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

PT-2026-61327

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the NFC LLCP connection state machine. The issue occurs when a connection acceptance packet CC is processed concurrently with a socket release, potentially...

PT-2026-61188

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A data-race exists in the Bluetooth ISO implementation. The functions iso connect bis, iso connect cis, iso listen bis, and iso conn big sync call hci get route using the dst, src, and s...

PT-2026-61288

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between the sctp wait for connect function and the peeloff process. The sctp wait for connect function releases and subsequently re-acquires the socket lock while...

CVE-2026-53358

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanuplisten l2capchanclose removes the channel from conn-chanl, which must be done under conn-lock. cleanuplisten runs under the parent sklock, so acquiring conn-lock would...

CVE-2026-52917

In the Linux kernel, the following vulnerability has been resolved: sctp: diag: reject stale associations in dumpone path The SCTP exact sockdiag lookup can hold a transport reference, block on locksocksk, and then resume after sctpassociationfree has marked the association dead and freed its bin...