23127 matches found
kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, allows an attacker to access memory after it has been freed. This can lead to a system crash, resulting in a Denial of Service DoS, or potentially enable an attacker to execute malicious code. Th...
kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report()
A flaw was found in the Linux kernel's Bluetooth Human Interface Device Protocol HIDP. A remote attacker, by sending specially crafted truncated packets from a paired Bluetooth device, could trigger an out-of-bounds read in the hidpinputreport function. This vulnerability may lead to unintended...
kernel: Bluetooth: serialize accept_q access
A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition exists in the handling of the acceptq within the btsockpoll function due to a lack of synchronization. This could allow a local attacker to cause a denial of service by manipulating socket operations during child teardow...
kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A race condition in the rfcommconnectind function, specifically during the handling of listener sockets, can lead to a use-after-free vulnerability. A local attacker could exploit this to cause a deni...
kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
A flaw was found in the Bluetooth subsystem of the Linux kernel, specifically within the hcisync component. This vulnerability occurs when the hciadvbcastannoucement function attempts to prepend Broadcast Announcement service data to an existing advertising payload that is already at its maximum...
kernel: Bluetooth: ISO: fix UAF in iso_recv_frame
A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream subsystem. This vulnerability, known as a Use-After-Free, occurs because the system attempts to use a memory area after it has been released, which can lead to unpredictable behavior. A malicious actor could potentially explo...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
A flaw was found in the Linux kernel's Bluetooth subsystem. Improper handling of locking within the hciconnrequestevt function, particularly when the HCIPROTODEFER protocol is active, can result in a Use-After-Free UAF vulnerability. This condition arises when a connection object is accessed afte...
kernel: Bluetooth: virtio_bt: clamp rx length before skb_put
A flaw was found in the Linux kernel's virtio Bluetooth virtiobt driver. A malicious or faulty virtualized Bluetooth device could send a specially crafted message with an incorrect length. This could lead to the kernel reading uninitialized memory, potentially exposing sensitive information from...
kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response
A flaw was found in the Linux kernel's Bluetooth Security Manager Protocol SMP. An attacker could exploit this vulnerability during the Bluetooth pairing process by manipulating authentication requirements. This could lead to the selection of a weaker pairing method than intended, potentially...
kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
A flaw was found in the Bluetooth L2CAP Logical Link Control and Adaptation Protocol component of the Linux kernel. When a device receives a connection response with an already-assigned destination Channel Identifier CID, the system may crash. This occurs because the kernel's procedure for...
BLUE-SPY
BLUE-SPY - Fast Pair 脆弱性調査ツール セキュリティ免責事項と法的警告 ⚠️ 本ソフトウェアは、認可されたセキュリティ研究および倫理的なテストのみを目的としています。⚠️ このツールを、あなたが所有していない、または明示的な書面による許可を得ていないデバイスに対して不正に使用することは 違法 であり、以下の結果を招く可能性があります。 世界各国のコンピュータ詐欺および不正使用防止法（CFAA）および類似の法律に基づく刑事訴追 プライバシー侵害および不正アクセスに対する民事訴訟 盗聴罪 重大な法的・金銭的制裁...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...
PT-2026-87739
Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-79378
The Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC is vulnerable in its firmware v3.x and earlier due to an issue in the btm_acl_handle() function. An attacker can trigger a Denial of Service (DoS) by sending a crafted L2CAP packet . While the CVSS score indicates a High severity (7.5) with a Ne...
PT-2026-87074
An issue in the btm acl handle function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service DoS via sending a crafted L2CAP packet...
CVE-2026-79377
A heap overflow in the a2dpdecodersbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service DoS via sending a crafted L2CAP packet...
