blur

README Repositorio sobre los ataques BLUR presentados en AsiaCCS'22 en el artículo titulado: BLURtooth: Exploiting Cross-Transport Key Derivation in Bluetooth Classic and Bluetooth Low Energy. Enlaces útiles: pdf, video, slides, website. Entrada BibTex: @inproceedingsantonioli22blur,...

CVE-2026-11109-Bluetooth-Classic-KNOB-Attack-Key-Negotiation-of-Bluetooth-

CVE-2026-11109 – Bluetooth Classic KNOB Attack Key Negotiation of Bluetooth Program Code Python Simulated knobattacksim.py - Simulates negotiation of encryption key size to 1 byte import random, hashlib class BluetoothDevice: def negotiatekeysizeself, proposedsize: Vulnerable: accepts any key siz...

JXL_Infotainment_CVE-2025-63895

JXLInfotainmentCVE-2025-63895 CVE-2025-63895 Attack Name 📂 Additional Details Afftected product Affected Components Bluetooth Classic version 5.0 Bluetooth firmware stack LMP implementation Infotainment Bluetooth service Attack Vector An attacker within Bluetooth range can exploit this issue by...

EUVD-2026-75212

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-15460 Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-15460 Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-15460: Operation on Resource in Wrong Phase of Lifetime

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-10680

The Classic BR/EDR L2CAP signaling handlers l2capbrconfreq and l2capbrconfrsp in subsys/bluetooth/host/classic/l2capbr.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling header...

CVE-2026-10680

CVE-2026-10680 affects Zephyr Project’s Classic BR/EDR L2CAP signaling: l2cap_br_conf_req() and l2cap_br_conf_rsp() validate the per-command length against the whole PDU length (buf->len) instead of the per-command len, allowing underflow of opt_len and an out-of-bounds read/write during confi...

CVE-2026-10680 Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

The Classic BR/EDR L2CAP signaling handlers l2capbrconfreq and l2capbrconfrsp in subsys/bluetooth/host/classic/l2capbr.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling header...

CVE-2026-10680 Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

The Classic BR/EDR L2CAP signaling handlers l2capbrconfreq and l2capbrconfrsp in subsys/bluetooth/host/classic/l2capbr.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling header...

EUVD-2026-46449

The Classic BR/EDR L2CAP signaling handlers l2capbrconfreq and l2capbrconfrsp in subsys/bluetooth/host/classic/l2capbr.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling header...

PT-2026-62127

The Classic BR/EDR L2CAP signaling handlers l2cap br conf req and l2cap br conf rsp in subsys/bluetooth/host/classic/l2cap br.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling...

CVE-2026-10654

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack subsys/bluetooth/host/classic/rfcomm.c mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown state BTRFCOMMSTATEDISCONNECTING, DISC sent, RTX timer armed and the connect...

CVE-2026-10654

The CVE-2026-10654 issue is a race in Zephyr’s Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c): when one side initiates a session teardown and the peer simultaneously sends a DISC for DLCI 0, rfcomm_handle_disc() forces the session to DISCONNECTED without calling bt_l...

EUVD-2026-40369

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack subsys/bluetooth/host/classic/rfcomm.c mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown state BTRFCOMMSTATEDISCONNECTING, DISC sent, RTX timer armed and the connect...

CVE-2026-10654 RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack subsys/bluetooth/host/classic/rfcomm.c mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown state BTRFCOMMSTATEDISCONNECTING, DISC sent, RTX timer armed and the connect...

CVE-2026-10654 RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack subsys/bluetooth/host/classic/rfcomm.c mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown state BTRFCOMMSTATEDISCONNECTING, DISC sent, RTX timer armed and the connect...

CVE-2026-10654: Concurrent Execution using Shared Resource with Improper Synchronization

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack subsys/bluetooth/host/classic/rfcomm.c mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown state BTRFCOMMSTATEDISCONNECTING, DISC sent, RTX timer armed and the connect...

PT-2026-53913

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack subsys/bluetooth/host/classic/rfcomm.c mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown state BT RFCOMM STATE DISCONNECTING, DISC sent, RTX timer armed and the...