https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T17:32:08.666986+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-74511 BELL-CVE-2026-74511 2026-10-06T17:32:08.753633+00:00

Affected: Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

 https://cve.radiocsirt.org/vuln/fkie_cve-2026-74511 fkie_cve-2026-74511 2026-10-06T17:32:08.753684+00:00

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

 https://cve.radiocsirt.org/vuln/ghsa-w59r-gmf8-wg42 GHSA-w59r-gmf8-wg42 2026-10-06T17:32:08.753711+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix pending command UAF in EIR updates

MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID.

pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME. In addition, it walked hdev->mgmt_pending without hdev->mgmt_pending_lock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed.

Take hdev->mgmt_pending_lock while scanning hdev->mgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev->short_name.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-74511 msrc_CVE-2026-74511 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. 2026-10-06T17:32:08.753743+00:00 msrc_CVE-2026-74511 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-74511 UBUNTU-CVE-2026-74511 2026-10-06T17:32:08.753761+00:00

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 95 more

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2852 WID-SEC-W-2026-2852 — Linux Kernel: Mehrere Schwachstellen 2026-10-06T17:32:08.753898+00:00

Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um root Rechte zu erlangen, um einen Denial of Service herbeizuführen oder einen nicht näher spezifizierten Angriff durchzuführen.