CVE-2023-2002

Linux Bluetooth: Unauthorized management command execution CVE-2023-2002 An insufficient permission check has been found in the Bluetooth subsystem of the Linux kernel when handling ioctl system calls of HCI sockets. This causes tasks without the proper CAPNETADMIN capability can easily mark HCI...

ROS-20260928-73-0094

The vulnerability of the scosockkill function in the net/bluetooth/sco.c module of the Linux Bluetooth subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

ROS-20260928-73-0080

The vulnerability of the recvpkt function in the net/bluetooth/6lowpan.c module of the Linux Bluetooth subsystem is related to the improper disabling or release of resources. Exploiting this vulnerability could allow a malicious actor to cause service failure remotely...

ROS-20260928-73-0086

The vulnerability of the btusbdisconnect function in the drivers/bluetooth/btusb.c module of the Linux Bluetooth device driver framework is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

ROS-20260928-73-0093

The vulnerability of the bcsprecv function in the drivers/bluetooth/hcibcsp.c module of the Linux Bluetooth device driver framework is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

Linux Distros Unpatched Vulnerability : CVE-2026-89569

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding...

Linux Distros Unpatched Vulnerability : CVE-2026-89583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it...

CVE-2026-80914 Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

Linux Distros Unpatched Vulnerability : CVE-2026-80760

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it...

Linux Distros Unpatched Vulnerability : CVE-2026-80759

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciaml: validate firmware segment lengths amldownloadfirmware reads two lengths from the firmware header and uses them to build pointers before...

CVE-2026-80763 Bluetooth: hci_event: validate LE Set CIG Parameters response

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

CVE-2026-80761

CVE-2026-80761 is a kernel information disclosure in the Linux kernel's Bluetooth ISO (Isochronous) socket subsystem. The function iso_sock_getname() populates a struct sockaddr_iso without first clearing it, causing uninitialized kernel stack bytes to be copied to user space via getsockname(2) o...

Linux Distros Unpatched Vulnerability : CVE-2026-80762

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each...

Linux Distros Unpatched Vulnerability : CVE-2026-80764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers...

Linux Distros Unpatched Vulnerability : CVE-2026-80763

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response...

Linux Distros Unpatched Vulnerability : CVE-2026-80819

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any...

Linux Bluetooth download_firmware() DoS

The vulnerability of the downloadfirmware function in the drivers/bluetooth/hcill.c file of the Bluetooth device driver for the Linux operating system is related to incomplete filtering of special elements. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-80666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: sco: Fix a race condition in scosocktimeout scosocktimeout runs asynchronously an...

Linux Distros Unpatched Vulnerability : CVE-2026-80683

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via...

CVE-2026-80692

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...