CVE-2026-85034

The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to btgattsubscribeparams::notify callbacks using only the length derived from the received ATT PDU. btattrecv in subsys/bluetooth/host/att.c...

CVE-2026-85033

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...

CVE-2026-85034

The Zephyr RTOS Bluetooth host's GATT client is vulnerable to an out-of-bounds write when processing Handle Value Notifications , Indications , or Multiple Handle Value Notifications . The root cause is that bt_att_recv() fails to enforce the negotiated ATT MTU, and the L2CAP channel lacks an rx....

CVE-2026-85034 Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers

The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to btgattsubscribeparams::notify callbacks using only the length derived from the received ATT PDU. btattrecv in subsys/bluetooth/host/att.c...

EUVD-2026-115822

The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to btgattsubscribeparams::notify callbacks using only the length derived from the received ATT PDU. btattrecv in subsys/bluetooth/host/att.c...

EUVD-2026-115821

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...

Linux Distros Unpatched Vulnerability : CVE-2026-82388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by...

Linux Distros Unpatched Vulnerability : CVE-2026-81039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Bluetooth host pre-allocates a btconn object a reservation from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddcon...

CVE-2026-81039

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...

CVE-2026-81039

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...

UBUNTU-CVE-2026-81039

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...

EUVD-2026-109971

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...

PT-2026-123418

The Bluetooth host pre-allocates a bt conn object a "reservation" from the fixed acl conns pool for every connectable advertising set it starts, in le adv start add conn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, find pending connect in...

CVE-2026-98730

A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. A local user with access to the Bluetooth Host Controller Interface HCI user channel can inject an oversized transmission packet. Because the driver fails to validate packet length before copying data into a fixed-size memory...

EUVD-2026-107483

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bta2dpcodecie, a one-byte len field plus a fixed 8-byte codecie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dpprocessconfigind in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes...

PT-2026-120772

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bt a2dp codec ie, a one-byte len field plus a fixed 8-byte codec ie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dp process config ind in subsys/bluetooth/host/classic/a2dp.c copied only the first ...

EUVD-2026-98924

The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...

CVE-2026-19939: Expired Pointer Dereference

The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...

PT-2026-111724

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp ag.c keeps its struct bt hfp ag objects in a static pool indexed by ACL connection index. On link teardown, hfp ag disconnected cancels ag-tx work and the per-call work items and then clears...

CVE-2026-19940: Use After Free

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...