Linux Bluetooth btusb_work Heap Buffer Overflow DoS

The vulnerability of the btusbwork function in the drivers/bluetooth/btusb.c module of the Linux Bluetooth device driver lies in a buffer overflow in the dynamic memory. Exploiting this vulnerability could allow an attacker to cause a system failure...

Linux kernel Bluetooth L2CAP Buffer Overflow

The vulnerability of the l2capinformationrsp function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

Linux kernel Bluetooth L2CAP Buffer Overflow

The vulnerability of the l2capecredconnreq function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to a numerical overflow issue. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

Linux kernel Bluetooth L2CAP Buffer Overflow DoS

The vulnerabilities of the functions l2capdisconnectreq and l2capdisconnectrsp in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem are related to the reutilization of previously freed memory due to concurrent access to resources. Exploiting these vulnerabilities coul...

Linux Bluetooth Data Compromise

The vulnerability of the Linux operating system’s Bluetooth kernel implementation is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information...

Linux kernel Bluetooth L2CAP Buffer Overflow DoS

The vulnerability of the l2capecredconnreq function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to gain access to protected...

Bluetooth Protocol Analyzer DoS

The vulnerability of the Bluetooth protocol analyzer, specifically the traffic analysis module of Wireshark, relates to reading beyond the buffer in memory. Exploiting this vulnerability can allow a hacker to cause a service failure...

Wireshark Bluetooth AVRCP DoS

The vulnerability of the Bluetooth AVRCP protocol analyzer and the traffic analysis module of Wireshark is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow attackers to cause service failures...

Linux Bluetooth btintelHW_error() Buffer Overflow

The vulnerability of the btintelHWerror function in the drivers/bluetooth/btintel.c module of the Linux Bluetooth device driver is related to synchronization errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

Linux kernel Bluetooth mgmt_add_adv_patterns_monitorComplete() Data Compromise

The vulnerability of the mgmtaddadvpatternsmonitorComplete function in the net/bluetooth/mgmt.c module of the Linux kernel’s Bluetooth subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Bluetooth HFP Profile Analyzer DoS

The vulnerability of the Bluetooth HFP Profile analyzer, a traffic analyzer for computer networks in Wireshark, relates to reading beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-13213

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

EUVD-2026-65003

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213

Zephyr RTOS Bluetooth Hearing Access Service (HAS) GATT server (subsys/bluetooth/audio/has.c) contains a NULL-pointer dereference in security_changed(). The connection-callback set is installed unconditionally via BT_CONN_CB_DEFINE, so the callback fires before the application calls bt_has_regist...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: Proper handling of “hold” state in “isoconnready”. The dereferencing of “sk” in “isoconnready” must be done either under “conn-lock” or while holding the reference count, to avoid concurrent closure. Currently,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: holding the connection in the hciconnectbigsync callback. There is a theoretical use-after-free vulnerability if the connection is freed while the hcisync task is running. The issue is mitigated by keeping tra...