462 matches found
CVE-2026-93783
A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. This vulnerability allows an attacker within Bluetooth range to cause a Denial of Service DoS or trigger an information disclosure by transmitting specially crafted, truncated, or zero-length frames...
CVE-2025-13834-A-Bluetooth-RFCOMM-Out-of-Bounds-Read-Vulnerability-in-Modern-Wireless-Devices
= doi.org/10.5281/zenodo.18323302 = orcid.org/0009-0007-7728-256X README.md: CVE-2025-13834 RFCOMM Bluetooth "Heartbleed" Exploitation Framework Author: Sastra Adi Wiguna Purple Elite Teaming Date: January 20, 2026 Version: 1.0 Full-System Replication License: RED TEAM USE ONLY Do not distribute...
CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom
CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom A Bluetooth Classic RFCOMM service of Parani M10 Intercom is exposed without enforcing secure authentication or proper access control. Once within range, any device can Establish a connection without proper...
CVE-2026-99008
A flaw was found in the Linux kernel's Bluetooth subsystem. When an RFCOMM Radio Frequency Communication terminal device fails to register properly during initialization, closing the device triggers a null pointer dereference in the shutdown handler. A local attacker could exploit this...
CVE-2026-99010
A flaw was found in the Linux kernel's Bluetooth Radio Frequency Communication RFCOMM subsystem. When a communication socket is closed while the underlying connection session remains active, incoming data packets are not released from memory. A remote attacker can exploit this vulnerability by...
CVE-2026-99009
A flaw was found in the Linux kernel's Bluetooth Radio Frequency Communication RFCOMM subsystem. A circular locking dependency can occur when an RFCOMM connection is initiated while a Bluetooth link is undergoing authentication or encryption. A local user can exploit this issue to trigger a...
SUSE CVE-2026-99009
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...
PT-2026-128323
Alpine iLX-F511 libanwbtstack.so prh rfcomm cc process test Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the abili...
SUSE CVE-2026-99010
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...
CVE-2026-82389 Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...
CVE-2026-82388 Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host
bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by passing the object's embedded hf-sdpparam to btsdpdiscover. That call links the caller-owned parameter block into the SDP client's request...
SUSE CVE-2026-99008
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed. rfcommdevadd puts the new device on rfcommdevlist first and only then...
DEBIAN-CVE-2026-99009
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...
DEBIAN-CVE-2026-99008
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed. rfcommdevadd puts the new device on rfcommdevlist first and only then...
AZL-110858 CVE-2026-99010 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...
CVE-2026-99010
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...
AZL-110855 CVE-2026-99009 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...
DEBIAN-CVE-2026-99010
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...
CVE-2026-99008
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed. rfcommdevadd puts the new device on rfcommdevlist first and only then...
CVE-2026-99009
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...