kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A race condition in the rfcommttysettermios function allows a session to be freed while it is still actively in use. This use-after-free UAF vulnerability can be exploited by a local attacker. Successful exploitation leads to a...

kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A race condition in the rfcommttysettermios function allows a session to be freed while it is still actively in use. This use-after-free UAF vulnerability can be exploited by a local attacker. Successful exploitation leads to a...

kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A malicious remote device could exploit this vulnerability by sending specially crafted, truncated Multiplexing Control Channel MCC frames. This lack of proper validation of incoming data length befor...

kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A race condition in the rfcommconnectind function, specifically during the handling of listener sockets, can lead to a use-after-free vulnerability. A local attacker could exploit this to cause a deni...

kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A race condition in the rfcommttysettermios function allows a session to be freed while it is still actively in use. This use-after-free UAF vulnerability can be exploited by a local attacker. Successful exploitation leads to a...

kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A malicious remote device could exploit this vulnerability by sending specially crafted, truncated Multiplexing Control Channel MCC frames. This lack of proper validation of incoming data length befor...

kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A race condition in the rfcommconnectind function, specifically during the handling of listener sockets, can lead to a use-after-free vulnerability. A local attacker could exploit this to cause a deni...

Linux Distros Unpatched Vulnerability : CVE-2026-90088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame witho...

EUVD-2026-81949

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

CVE-2026-90088 Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

CVE-2025-13834-A-Bluetooth-RFCOMM-Out-of-Bounds-Read-Vulnerability-in-Modern-Wireless-Devices

= doi.org/10.5281/zenodo.18323302 = orcid.org/0009-0007-7728-256X README.md: CVE-2025-13834 RFCOMM Bluetooth "Heartbleed" Exploitation Framework Author: Sastra Adi Wiguna Purple Elite Teaming Date: January 20, 2026 Version: 1.0 Full-System Replication License: RED TEAM USE ONLY Do not distribute...

CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom

CVE-2026-31280-不安全蓝牙RFCOMM导致Parani M10对讲机设备崩溃 Parani M10对讲机的蓝牙经典RFCOMM服务在未强制执行安全认证或适当访问控制的情况下暴露。一旦进入信号范围内，任何设备都可以在无适当配对限制的情况下建立连接，直接访问RFCOMM通道，或发送任意或畸形载荷 该漏洞的概念验证（PoC）记录在随附的PDF中，该PDF最初是为内部安全审查而提供给相应组织的。 发现者 - Nikhil YalgarCipherX1802 和 Tapadyuti Baral...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

A NULL pointer dereference vulnerability exists in the Linux kernel on Linux, x86, and ARM platforms including networking and Bluetooth modules. This vulnerability is related to the /net/bluetooth/rfcomm/core.C file. This issue affects the Linux kernel version v2.6.12-rc2...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fixed a possible deadlock in rfcommskstatechange. syzbot reports a possible deadlock in rfcommskstatechange 1. While rfcommsockconnect acquires the sk lock and waits for the rfcomm lock, rfcommsockrelease might acquire...

kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A race condition in the rfcommconnectind function, specifically during the handling of listener sockets, can lead to a use-after-free vulnerability. A local attacker could exploit this to cause a deni...

kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A malicious remote device could exploit this vulnerability by sending specially crafted, truncated Multiplexing Control Channel MCC frames. This lack of proper validation of incoming data length befor...

Linux Distros Unpatched Vulnerability : CVE-2026-89569

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding...

CVE-2026-89569

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. This vulnerability arises because the system does not properly manage memory when handling Bluetooth security confirmations. A race condition allows a part of the system to free memory that is still in use by another part, leading...

CVE-2026-89569

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

AZL-100721 CVE-2026-89569 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...