Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt

...

PT-2026-36439

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the hci cmd sync queue once function fails to indicate whether a queue item was added. This prevents the caller from knowing if callbacks...

EUVD-2026-1849

Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver. This issue affects Apache NimBLE: through 1.8. This issue requires a broken or bogus Bluetooth controller and thus severity is considered low. Users are...

CVE-2025-53477

CVE-2025-53477 is a NULL pointer dereference vulnerability in Apache NimBLE (NimBLE host HCI layer). The issue stems from missing validation of HCI connection complete or HCI command TX buffers, which can lead to a NULL pointer dereference when combined with disabled asserts and a malfunctioning ...

CVE-2025-64342 ESF-IDF's ESP32 Bluetooth Controller Has an Invalid Access Address Vulnerability

ESF-IDF is the Espressif Internet of Things IOT Development Framework. When the ESP32 is in advertising mode, if it receives a connection request containing an invalid Access Address AA of 0x00000000 or 0xFFFFFFFF, advertising may stop unexpectedly. In this case, the controller may incorrectly...

CVE-2025-47370

Technical details, affected product/versions, root cause, and fixes for CVE-2025-47370 are not publicly provided in the supplied documents. Monitor for updates from vendors/security bulletins.

CVE-2025-47370 Reachable Assertion in BT Controller

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan...

CVE-2025-47342

CVE-2025-47342 concerns Qualcomm chipsets where a transient denial-of-service can occur due to concurrency involving QHS and multi-profile configurations. The Red Hat/NVD/CVE records describe the issue as a transient DOS when multiple profiles are used concurrently with QHS enabled; the CVE List ...

CVE-2025-47342 Use After Free in BT Controller

Transient DOS may occur when multi-profile concurrency arises with QHS enabled...

CVE-2025-47342 Use After Free in BT Controller

Transient DOS may occur when multi-profile concurrency arises with QHS enabled...

EUVD-2021-21737

Malware in sbrugna...

EUVD-2017-9306

Malware in sbrugna...

EUVD-2021-21773

Malware in sbrugna...

EUVD-2017-9305

Malware in sbrugna...

EUVD-2021-19253

Malware in sbrugna...

EUVD-2023-33744

Malicious code in bioql PyPI...

EUVD-2023-32257

Malicious code in bioql PyPI...

EUVD-2023-12458

Malicious code in bioql PyPI...

CVE-2025-47318 Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern...

CVE-2025-47318 Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern...