CVE-2026-99013

The Linux kernel contains a vulnerability in the Bluetooth ISO stack where concurrent listen() calls on the same broadcast socket can lead to a slab-use-after-free condition. This occurs because iso_sock_listen() drops the socket lock before calling iso_listen_bis(), allowing two callers to simul...

CVE-2026-99013 Bluetooth: ISO: Reject concurrent BIS listener setup

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore both...

CVE-2026-99012

The Linux kernel is vulnerable to a slab-use-after-free vulnerability in the Bluetooth ISO stack. The root cause is a race condition in iso_sock_connect(), where the function releases the socket lock before completing the connection setup, allowing concurrent callers to bypass admission checks. T...

CVE-2026-99012 Bluetooth: ISO: Serialize concurrent connect calls

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls isosockconnect checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while...

CVE-2026-99012 Bluetooth: ISO: Serialize concurrent connect calls

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls isosockconnect checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while...

EUVD-2026-108806

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls isosockconnect checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while...

CVE-2026-99011

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

CVE-2026-99011 Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

EUVD-2026-108805

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

CVE-2026-99011 Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

CVE-2026-99011

The Linux kernel is affected by a slab-use-after-free vulnerability in the Bluetooth SCO component. The issue arises because sco_recv_scodata() upgrades a weak back-pointer to a strong reference under hdev->lock, but the pointer is cleared by sco_conn_free() without holding that same lock. Thi...

CVE-2026-99006 drm/i915/gem: Prevent overstepping exec array boundary

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...

EUVD-2026-108800

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...

CVE-2026-99001 drm/xe/i2c: cancel the client work on remove

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

CVE-2026-99001 drm/xe/i2c: cancel the client work on remove

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

CVE-2026-99001

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

EUVD-2026-108795

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

CVE-2026-99001

The Linux kernel contains a vulnerability in the drm/xe/i2c component where xe_i2c_remove() fails to drain i2c->work during teardown. This allows a queued or running work item to dereference i2c->adapter after it has been released by platform_device_unregister(). Additionally, because the w...

CVE-2026-98999 drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...

EUVD-2026-108793

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...