CVE-2026-89583

A flaw was found in the Linux kernel's Bluetooth subsystem. An out-of-bounds OOB read vulnerability exists in the eirgetservicedata function due to incorrect length calculation when parsing Extended Inquiry Response EIR advertising data. A remote attacker, by sending a specially crafted periodic...

CVE-2026-89583

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

CVE-2026-89583 Bluetooth: eir: Fix OOB read in eir_get_service_data()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

EUVD-2026-76495

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

CVE-2026-89583

CVE-2026-89583 affects the Linux kernel Bluetooth EIR subsystem. The function eir_get_service_data() walks advertising data for a matching Service Data UUID but incorrectly decrements eir_len by only the field's data length, omitting the length and type bytes. This shortfall compounds across skip...

EUVD-2026-43512

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix memory leak in hcilebigterminate hcilebigterminate allocates isolistdata via kzallocobj but returns 0 without freeing it when neither pasyncterm nor bigsyncterm flags are set after evaluating the PA and BI...

CVE-2026-53364

The CVE-2026-53364 vulnerability is in the Linux kernel Bluetooth HCI path: hci_le_big_terminate() may leak memory (iso_list_data) when neither pa_sync_term nor big_sync_term flags are set after PA/BIG state evaluation. The function was refactored to accept a struct hci_conn and added PA/BIG flag...

PT-2026-57836

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the Bluetooth component within the hci le big terminate function. The issue occurs when the function allocates iso list data using kzalloc obj but returns 0 witho...

CVE-2023-21195

In btmbleperiodicadvsynctxrcvd of btmblegap.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure over Bluetooth, if the firmware were compromised with System execution privileges needed. User interaction is not needed for...

PT-2023-17983 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to Android-13 Description: The issue is related to a possible out of bounds read in the btm ble periodic adv sync tx rcvd function of btm ble gap.cc. This could lead to local information disclosure over Bluetooth if the...

CVE-2023-21130

In btmbleperiodicadvsynclost of btmblegap.cc, there is a possible remote code execution due to a buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID...

PT-2023-17922 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: A buffer overflow in the btm ble periodic adv sync lost function of btm ble gap.cc could lead to remote code execution with no additional execution privileges needed. User interaction is not required f...

CVE-2023-20991

In btmbleprocessperiodicadvsynclostevt of blescannerhciinterface.cc , there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product:...

Google Pixel 缓冲区错误漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from a buffer overflow vulnerability that originates from a boundary error in processing data in btmbleprocessperiodicadvsynclostevt in blescannerhciinterface.cc, which can be exploited by an attacker to...

CVE-2017-13288

In writeToParcel and readFromParcel of PeriodicAdvertisingReport.java, there is a permission bypass due to a 64/32bit int mismatch. This could lead to a local escalation of privilege where the user can start an activity with system privileges, with no additional execution privileges needed. User...

Google Android System Elevation of Privilege Vulnerability (CNVD-2018-07452)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An elevation vulnerability exists in the writeToParcel and readFromParcel of the PeriodicAdvertisingReport.java file in Android versions 8.0 and 8.1. A local attacker can exploit...