https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:51:19 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-68389 <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-68389 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1069 certfr-2026-avi-1069 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1069 https://cve.radiocsirt.org/vuln/euvd-2026-353585 EUVD-2026-353585 https://cve.radiocsirt.org/vuln/euvd-2026-353585 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68389 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_qca: Clear memdump state on invalid dump size</p> <p>qca_controller_memdump() allocates qca-&gt;qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size.</p> <p>If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca-&gt;qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca-&gt;qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump.</p> <p>Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails.</p> <p>A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_qca: Clear memdump state on invalid dump size</p> <p>qca_controller_memdump() allocates qca-&gt;qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size.</p> <p>If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca-&gt;qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca-&gt;qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump.</p> <p>Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails.</p> <p>A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-68389 https://cve.radiocsirt.org/vuln/ghsa-ghf3-w254-j47x <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_qca: Clear memdump state on invalid dump size</p> <p>qca_controller_memdump() allocates qca-&gt;qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size.</p> <p>If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca-&gt;qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca-&gt;qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump.</p> <p>Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails.</p> <p>A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_qca: Clear memdump state on invalid dump size</p> <p>qca_controller_memdump() allocates qca-&gt;qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size.</p> <p>If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca-&gt;qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca-&gt;qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump.</p> <p>Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails.</p> <p>A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path.</p> https://cve.radiocsirt.org/vuln/ghsa-ghf3-w254-j47x https://cve.radiocsirt.org/vuln/msrc_cve-2026-68389 msrc_CVE-2026-68389 https://cve.radiocsirt.org/vuln/msrc_cve-2026-68389 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21910-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21910-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23881-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23881-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68389 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 154 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Clear memdump state on invalid dump size qca_controller_memdump() allocates qca-&gt;qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size. If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca-&gt;qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca-&gt;qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump. Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails. A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 154 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Clear memdump state on invalid dump size qca_controller_memdump() allocates qca-&gt;qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size. If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca-&gt;qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca-&gt;qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump. Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails. A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68389 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2730 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Ausweitung von Berechtigungen, die Offenlegung von Informationen, die Manipulation von Daten oder Denial-of-Service-Zustände.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Ausweitung von Berechtigungen, die Offenlegung von Informationen, die Manipulation von Daten oder Denial-of-Service-Zustände.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2730