btmtk btmtk_usb_isointf_init Heap Buffer Overflow DoS

Vulnerability of the btmtkusbisointfinit function in the drivers/bluetooth/btmtk.c module – The Bluetooth device support driver in Linux operating systems relies on pointer swapping. Exploiting this vulnerability could allow an attacker to cause a service failure...

Siemens SIMATIC S7-1500 Use After Free (CVE-2023-40283)

An issue was discovered in l2capsockrelease in net/bluetooth/l2capsock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Siemens SIMATIC Devices Race Condition (CVE-2024-24857)

A race condition was found in the Linux kernel's net/bluetooth device driver in conninfomin,maxageset function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service. This plugin only works with Tenable.ot. Please visit...

Linux Distros Unpatched Vulnerability : CVE-2025-39983

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciconntxdequeue This fixes the following UAF caused by not...

Linux Distros Unpatched Vulnerability : CVE-2016-3744

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in the createpbuf function in btif/src/btifhh.c in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before...

CVE-2025-38593 Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: fix double free in 'hcidiscoveryfilterclear' Function 'hcidiscoveryfilterclear' frees 'uuids' array and then sets it to NULL. There is a tiny chance of the following race: 'hcicmdsyncwork'...

Linux Distros Unpatched Vulnerability : CVE-2025-38473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ubuntu Linux - Bluetooth: Fix null-ptr-deref in l2capsockresumecb syzbot reported null-ptr-deref in l2capsockresumecb. 0 l2capsockresumecb has a similar problem...

Linux Bluetooth Kernel Heap Buffer Overflow DoS

The vulnerability of the vhciFlush function in the include/linux/skbuff.h library of the Linux Bluetooth kernel component is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code, increase their privileges, or cause service...

Linux Distros Unpatched Vulnerability : CVE-2020-25661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with A2MP CID. This flaw...

Linux Distros Unpatched Vulnerability : CVE-2024-24860

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A race condition was found in the Linux kernel's bluetooth device driver in min,maxkeysizeset function. This can result in a null pointer dereference issue,...

Linux Bluetooth DoS

The vulnerability of the Linux operating system’s Bluetooth kernel component is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Bluetooth Kernel Component Heap Buffer Overflow DoS

The vulnerability of the hcigetrandomaddress function in the Linux operating system’s Bluetooth kernel component is related to a memory leak. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux kernel Bluetooth Buffer Overflow DoS

The vulnerability of the btintelpciesetuphdev function in the Linux kernel’s Bluetooth device support driver is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Bluetooth DoS

The vulnerability of the Linux operating system’s Bluetooth kernel component is related to improper error handling in the function isoinit in net/bluetooth/iso.c. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Bluetooth DoS

The vulnerability of the rfcommsocksetsockoptold and rfcommsocksetsockopt functions of the Linux kernel’s Bluetooth component is related to read-off-bounds errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Bluetooth DoS

The vulnerability of the scosocksetsockopt function in the Linux kernel’s Bluetooth component is related to read misses beyond the boundary. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Bluetooth Kernel Buffer Overflow DoS

The vulnerability of the hciunregisterdev function net/bluetooth/hcicore.c in the Linux operating system’s Bluetooth kernel driver is related to improper resource locking. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Bluetooth Kernel Heap Buffer Overflow DoS

The vulnerability of the isosocktimeout function in the net/bluetooth/iso.c module of the Linux operating system’s Bluetooth kernel implementation is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Linux Bluetooth Kernel Heap Buffer Overflow DoS

The vulnerability of the scosocktimeout function in the net/bluetooth/sco.c module of the Linux operating system’s Bluetooth kernel implementation is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Linux BlueZ HID Profile Arbitrary Command Execution

The vulnerability of the HID Profile interface of the Bluetooth protocol stack for the Linux BlueZ operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...