https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:24:33 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-80763 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-80763 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1163 certfr-2026-avi-1163 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1163 https://cve.radiocsirt.org/vuln/euvd-2026-363784 EUVD-2026-363784 https://cve.radiocsirt.org/vuln/euvd-2026-363784 https://cve.radiocsirt.org/vuln/fkie_cve-2026-80763 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_event: validate LE Set CIG Parameters response</p> <p>The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci_cc_le_set_cig_params() trusts num_handles and reads each entry in the trailing handle array.</p> <p>Matching num_handles against the command&#39;s num_cis does not guarantee that the response contains the advertised handles. A truncated response from a malfunctioning controller can therefore make the handler read beyond the skb data.</p> <p>Validate that the remaining skb data contains all advertised handles. Include this in the existing response validation so malformed responses also follow the established CIG failure handling.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_event: validate LE Set CIG Parameters response</p> <p>The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci_cc_le_set_cig_params() trusts num_handles and reads each entry in the trailing handle array.</p> <p>Matching num_handles against the command&#39;s num_cis does not guarantee that the response contains the advertised handles. A truncated response from a malfunctioning controller can therefore make the handler read beyond the skb data.</p> <p>Validate that the remaining skb data contains all advertised handles. Include this in the existing response validation so malformed responses also follow the established CIG failure handling.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-80763 https://cve.radiocsirt.org/vuln/ghsa-cxj6-pxrj-qc44 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_event: validate LE Set CIG Parameters response</p> <p>The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci_cc_le_set_cig_params() trusts num_handles and reads each entry in the trailing handle array.</p> <p>Matching num_handles against the command&#39;s num_cis does not guarantee that the response contains the advertised handles. A truncated response from a malfunctioning controller can therefore make the handler read beyond the skb data.</p> <p>Validate that the remaining skb data contains all advertised handles. Include this in the existing response validation so malformed responses also follow the established CIG failure handling.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_event: validate LE Set CIG Parameters response</p> <p>The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci_cc_le_set_cig_params() trusts num_handles and reads each entry in the trailing handle array.</p> <p>Matching num_handles against the command&#39;s num_cis does not guarantee that the response contains the advertised handles. A truncated response from a malfunctioning controller can therefore make the handler read beyond the skb data.</p> <p>Validate that the remaining skb data contains all advertised handles. Include this in the existing response validation so malformed responses also follow the established CIG failure handling.</p> https://cve.radiocsirt.org/vuln/ghsa-cxj6-pxrj-qc44 https://cve.radiocsirt.org/vuln/msrc_cve-2026-80763 msrc_CVE-2026-80763 https://cve.radiocsirt.org/vuln/msrc_cve-2026-80763 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11773-1 <p>kernel-devel-7.2.5-1.1 on GA media</p> <p>kernel-devel-7.2.5-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11773-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-80763 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 154 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci_cc_le_set_cig_params() trusts num_handles and reads each entry in the trailing handle array. Matching num_handles against the command&#39;s num_cis does not guarantee that the response contains the advertised handles. A truncated response from a malfunctioning controller can therefore make the handler read beyond the skb data. Validate that the remaining skb data contains all advertised handles. Include this in the existing response validation so malformed responses also follow the established CIG failure handling.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 154 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci_cc_le_set_cig_params() trusts num_handles and reads each entry in the trailing handle array. Matching num_handles against the command&#39;s num_cis does not guarantee that the response contains the advertised handles. A truncated response from a malfunctioning controller can therefore make the handler read beyond the skb data. Validate that the remaining skb data contains all advertised handles. Include this in the existing response validation so malformed responses also follow the established CIG failure handling.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-80763 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3211 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um Speicherfehler und Kernel-Abstürze beziehungsweise Denial-of-Service-Zustände auszulösen, Speicher außerhalb vorgesehener Grenzen auszulesen sowie in einzelnen Fällen weitere Sicherheitsauswirkungen zu verursachen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um Speicherfehler und Kernel-Abstürze beziehungsweise Denial-of-Service-Zustände auszulösen, Speicher außerhalb vorgesehener Grenzen auszulesen sowie in einzelnen Fällen weitere Sicherheitsauswirkungen zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3211