Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Handling of NULL sock pointer in l2capsockalloc A NULL sock pointer is passed into l2capsockalloc when it is called from l2capsocknewconnectioncb. Error handling mechanisms should also take this into account. A...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: l2cap: Check the encryption key size during incoming connections. This is required for passing the GAP/SEC/SEM/BI-04-C PTS test case: - Security Mode: 4, Level: 4, Responder: Invalid Encryption Key Size - Key Size:...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Fixed a use-after-free caused by l2capreassemblesdu. Fixed a race condition between the following two processes that run parallelly: 1. l2capreassemblesdu - chan-ops-recv l2capsockrecvcb - sockqueuercvskb. 2...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Fixed a nullptrderef issue in l2capsockreadycb. Before using a sk pointer, check if it is null. The following issues have also been fixed: KASAN: Nullptrderef in the range 0x0000000000000260-0x000000000000026...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fixed a memory leak in vhciwrite Syzkaller reported a memory leak as follows: ==================================== BUG: Memory leak Unreferenced object 0xffff88810d81ac00 size 240: ... Hex dump first 32 bytes: 0...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A vulnerability classified as critical was discovered in the Linux kernel. The vulnerability affects the function l2capreassemblesdu in the file net/bluetooth/l2capcore.c of the Bluetooth component. This vulnerability stems from improper memory management, leading to an attempt to reuse freed...

kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

A flaw was found in the Bluetooth L2CAP Logical Link Control and Adaptation Protocol component of the Linux kernel. When a device receives a connection response with an already-assigned destination Channel Identifier CID, the system may crash. This occurs because the kernel's procedure for...

CVE-2026-15460

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

EUVD-2026-75212

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-15460 Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-15460 Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-15460 Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-15460

CVE-2026-15460 affects Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP, specifically the receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c. The handler dispatched inbound data PDUs based solely on the destination channel ID without verifying the channel had reached BT_L2...

kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP implementation. A remote Bluetooth Low Energy BLE device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list,...

kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP implementation. A remote Bluetooth Low Energy BLE device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list,...

PT-2026-89182

The Bluetooth Classic BR/EDR L2CAP receive handler bt l2cap br recv in subsys/bluetooth/host/classic/l2cap br.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BT L2CAP CONNECTED state. A dynamic channel is assigned i...

CVE-2026-15460: Operation on Resource in Wrong Phase of Lifetime

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-79378

An issue in the btmaclhandle function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service DoS via sending a crafted L2CAP packet...

CVE-2026-79377

A heap overflow in the a2dpdecodersbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service DoS via sending a crafted L2CAP packet...

CVE-2026-79376

An issue in the l2caphandledata function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service DoS via sending a crafted L2CAP packet...