https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 21:27:00 +0000 https://vulnerability.circl.lu/vuln/cve-2026-68389 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_qca: Clear memdump state on invalid dump size</p> <p>qca_controller_memdump() allocates qca-&gt;qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size.</p> <p>If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca-&gt;qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca-&gt;qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump.</p> <p>Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails.</p> <p>A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_qca: Clear memdump state on invalid dump size</p> <p>qca_controller_memdump() allocates qca-&gt;qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size.</p> <p>If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca-&gt;qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca-&gt;qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump.</p> <p>Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails.</p> <p>A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path.</p> https://vulnerability.circl.lu/vuln/cve-2026-68389