CVE-2026-99014

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition between concurrent worker threads during Periodic Advertising PA sync scan setup can cause a command buffer to be freed while still in use. A local attacker could exploit this use-after-free flaw to cause a Denial of...

CVE-2026-99015

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can exploit this flaw to cause a Denial of Service DoS by crashing the system. Due to missing lock synchronization when rebinding a Host Controller Interface HCI socket after a controller is unregistered, a race conditio...

CVE-2026-99012

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can cause a Denial of Service DoS by issuing concurrent connection requests on Bluetooth isochronous ISO sockets. Due to improper locking and lack of serialization during connection establishment, simultaneous connect...

CVE-2026-99011

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition between connection termination and incoming data handling in the Synchronous Connection-Oriented SCO protocol can lead to a use-after-free condition. An attacker within Bluetooth range or a local user could exploit this...

CVE-2026-99013

A flaw was found in the Linux kernel's Bluetooth subsystem. A local user could cause a Denial of Service DoS due to a race condition during concurrent setup of Broadcast Isochronous Stream BIS socket listeners. By issuing simultaneous listen calls on the same broadcast socket, an attacker can...

CVE-2017-0541

poc and vulnerability analysis of CVE-2017-0541...

CVE-2026-80762

A flaw was found in the Bluetooth subsystem of the Linux kernel. During the system suspend process, a timing issue can occur where the hciupdateeventfiltersync function attempts to access memory that has already been released. This Use-After-Free UAF vulnerability could allow a local attacker to...

CVE-2023-7356

A flaw was found in the Linux kernel's Bluetooth subsystem. An adjacent attacker within Bluetooth range could exploit this flaw by broadcasting specially crafted Bluetooth Low Energy LE periodic advertisement packets. Because incoming advertisement data was copied into internal socket buffers...

CVE-2026-98809

A flaw was found in the Linux kernel's Bluetooth subsystem. When unregistering a Bluetooth device, pending synchronous commands are processed without reaching the controller, causing each queued request to wait for a full timeout. A local user can exploit this issue by queuing an unbounded number...

CVE-2026-80764

A flaw was found in the Linux kernel's Bluetooth subsystem. A local user could exploit a use-after-free vulnerability in the hcievent component. This occurs when the hciccreset function clears Bluetooth Low Energy LE lists without proper locking, allowing a debugfs reader to access freed memory...

CVE-2026-98736

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs during enhanced Synchronous Connection-Oriented SCO link setup due to missing locking when accessing parent connection structures. A local user or adjacent attacker could exploit this timing window by concurrently...

CVE-2026-98735

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when outgoing network packets are scheduled while the associated communication channel is concurrently closed and freed during connection teardown. A local attacker could exploit this flaw to trigger a...

CVE-2026-98734

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker could exploit this flaw to cause a Denial of Service DoS via a system crash or potentially escalate privileges. The vulnerability occurs due to improper synchronization between packet transmission scheduling and connecti...

CVE-2026-98632

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can trigger a use-after-free condition by cancelling a pending Bluetooth mesh transmission while it remains queued for processing. When the system later attempts to handle the queued transmission using the already freed...

CVE-2026-93247

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can cause a Denial of Service DoS due to a race condition in the service discovery management code. Under specific timing conditions, clearing discovery filters concurrently with starting service discovery leaves interna...

CVE-2026-98738

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when the Security Manager Protocol SMP accesses remote Out-of-Band OOB pairing data without proper locking while the data is concurrently being removed. A local attacker can exploit this flaw to trigger a...

CVE-2026-98737

A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local user to cause a Denial of Service DoS or potentially escalate privileges due to a use-after-free condition. The issue arises from a race condition where synchronous command routines access inquiry cache entries...

CVE-2026-98733

A flaw was found in the Linux kernel's Bluetooth subsystem. Inadequate synchronization when handling fragmented isochronous ISO data packets allows a race condition between packet queueing and transmission operations. A local user could exploit this flaw to trigger a use-after-free condition,...

CVE-2026-93209

A flaw was found in the Linux kernel's Bluetooth subsystem. Under conditions of memory pressure, a function responsible for handling Bluetooth commands can fail to properly track command completion. This can lead to intermittent failures when enabling Bluetooth, resulting in a denial of service...

CVE-2026-98458

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can cause a Denial of Service DoS through a reference count leak during Bluetooth Isochronous ISO channel attachment. When a socket attempts to attach to a channel that is already connected or in use by another socket, t...