CVE-2023-54038 Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: return ERRPTR instead of NULL when there is no link hciconnectsco currently returns NULL when there is no link i.e. when hciconnlink returns NULL. scoconnect expects an ERRPTR in case of any error see line 266...

CVE-2023-54038

The CVE-2023-54038 issue affects the Linux kernel Bluetooth HCI path. The root cause is that hci_connect_sco() (and similarly hci_connect_cis()) returned NULL on error, causing sco_conn_add() to dereference hcon->hdev and crash. The fix switches to returning an ERR_PTR on error for both hci_co...

CVE-2023-54038 Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: return ERRPTR instead of NULL when there is no link hciconnectsco currently returns NULL when there is no link i.e. when hciconnlink returns NULL. scoconnect expects an ERRPTR in case of any error see line 266...

CVE-2023-54036 wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU

In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU The wifi + bluetooth combo chip RTL8723BU can leak memory especially? when it's connected to a bluetooth audio device. The busy bluetooth traffic generates lots of C2H ca...

Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()

...

Linux Distros Unpatched Vulnerability : CVE-2023-54120

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: Fix race condition in hidpsessionthread There is a potential race condition in hidpsessionthread that may lead to use-after-free. For instance, the...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from Bluetooth hciconn returning NULL instead of ERRPTR when there is no connection, potentially resulting in a...

PT-2025-52995

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's Bluetooth implementation within the hci conn component. Specifically, the hci connect sco and hci connect cis functions were returning NULL when a lin...

The vulnerability of the hci_suspend_notifier() function in the net/bluetooth/hci_core.c file of the Linux operating system’s Bluetooth subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hcisuspendnotifier function in the net/bluetooth/hcicore.c file of the Linux kernel’s Bluetooth subsystem is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

PT-2025-53197

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists within the hidp session thread function, potentially leading to a use-after-free issue. Specifically, the timer may remain active while hidp del timer is invoked...

CLSA-2025-1766488019 kernel: Fix of 63 CVEs

scsi: target: iscsi: Fix timeout on deleted connection CVE-2025-38075 - tls: wait for pending async decryptions if tlsstrpmsghold fails CVE-2025-40176 - cloneprivatemnt: make sure that caller has CAPSYSADMIN in the right userns CVE-2025-38499 - rcu: Fix rcureadunlock deadloop due to IRQ work...

kernel: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2capdisconnectrsp conn-chanlock isn't acquired before l2capgetchanbyscid, if l2capgetchanbyscid returns NULL, then 'bad unlock balance' is triggered...

kernel: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2capdisconnectrsp conn-chanlock isn't acquired before l2capgetchanbyscid, if l2capgetchanbyscid returns NULL, then 'bad unlock balance' is triggered...

The vulnerability in the implementation of the AVRCP protocol of the Bluetooth protocol stack for the Linux BlueZ operating system allows a hacker to circumvent existing security restrictions.

The vulnerability of the AVRCP protocol implementation in the Bluetooth protocol stack for the Linux BlueZ operating system is related to reading data beyond the buffer limits of memory. Exploiting this vulnerability can allow a malicious actor to circumvent existing security restrictions using a...

The vulnerability in the implementation of the AVRCP protocol of the Bluetooth protocol stack for the Linux BlueZ operating system allows a hacker to circumvent existing security restrictions.

The vulnerability of the AVRCP protocol implementation in the Bluetooth protocol stack for the Linux BlueZ operating system is related to reading data beyond the buffer limits of memory. Exploiting this vulnerability can allow a malicious actor to circumvent existing security restrictions using a...

RHEL 7 : kernel (RHSA-2025:23947)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23947 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ALSA: usb-audio: Validate UAC...

RHEL 7 : kernel-rt (RHSA-2025:23960)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23960 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

SUSE CVE-2025-68298

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Avoid btusbmtkclaimisointf NULL deref In btusbmtksetup, we set btmtkdata-isopktintf to: usbifnumtoifdata-udev, MTKISOIFNUM That function can return NULL in some cases. Even when it returns NULL, though...

SUSE CVE-2025-68304

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: lookup hciconn on RX path on protocol side The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hciconn is not concurrently modified/deleted. This locking appears to be leftover from...

SUSE CVE-2025-68305

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmtpending before write iter sends the cmd, just as...