384 matches found
CVE-2020-0022
CVE-2020-0022 Seems like Android 9-6 have similar Bluetooth subsystem, Android 5 and 4 are different. Android 9.0 BlueFrag experiments Patch: https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf Below I hit the patched condition. OK I think I got it, but...
esp32-cve-2025-27840-power-trace-experiment
esp32-cve-2025-27840-power-trace-experiment Firmware para obtener una traza de potencia del comportamiento del módulo bluetooth en el ESP32 cuando se le envían los comandos hci de bluetooth no documentados CVE-2025-27840. Cuando el ESP32 recibe los comandos, alterna un pin GPIO para disparar la...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: In hcildisc,serdev, a failure in checking percpuinitrwsem. syzbot reports a NULL pointer dereferencing at hciuartttyclose. For rcusyncenter, rcusyncinit is called without calling hciuartttyopen, as hciuartttyopen...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcisync: fixed a race condition in hcicmdsyncdequeueonce. The function hcicmdsyncdequeueonce performs a lookup and then cancels the entry under two separate lock sections. Meanwhile, hcicmdsyncwork can also delete t...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hciqca: Fixed the driver shutdown when the serdev is closed. The driver shutdown callback which sends EDLSOCRESET to the device via serdev should not be invoked when the HCI device is not open e.g., if hcidevopensyn...
Important: Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syst...
SUSE CVE-2026-80762
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...
SUSE CVE-2026-80764
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...
Oracle Linux 10 : ELSA-2026-63128-0: / kernel (ELSA-2026-631280)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-631280 advisory. - net: ipv6: clear suppressed fib6 rule result Jamie Bainbridge RHEL-246368 CVE-2026-74581 - iomap: fix out-of-bounds bitmapset with zero-length ran...
SUSE CVE-2026-80763
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...
CVE-2026-80763
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...
AZL-99486 CVE-2026-80762 affecting package kernel 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...
AZL-99575 CVE-2026-80764 affecting package kernel 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...
AZL-99654 CVE-2026-80763 affecting package kernel 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...
CVE-2026-80762
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...
CVE-2026-80764 Bluetooth: hci_event: fix LE list UAF on reset
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...
CVE-2026-80764
CVE-2026-80764 affects the Linux kernel Bluetooth subsystem. The vulnerability is a use-after-free (UAF) in the HCI event handler: hci_cc_reset() clears the LE accept and resolving lists without acquiring hdev->lock , while debugfs readers (e.g., white_list_show) hold that lock while traversin...
CVE-2026-80764 Bluetooth: hci_event: fix LE list UAF on reset
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...
EUVD-2026-71407
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...