CVE-2023-21739

CVE-2023-21739 Windows Bluetooth Driver Elevation of Privilege Vulnerability. authentication| complexity| vector ---|---|--- not available| not available| not available confidentiality| integrity| availability ---|---|--- not available| not available| not available CVSS Score: not available...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel before version 5.16.3, the driver/bluetooth/hciqca.c file misinterprets the return value of devmgpiodgetindexoptional. It expects the return value to be NULL in the error case, but in reality, it is an error pointer...

The vulnerability of the hci_uart_register_dev() function in the drivers/bluetooth/hci_ldisc.c device driver of the Linux operating system’s Bluetooth kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hciuartregisterdev function in the drivers/bluetooth/hcildisc.c device driver of the Linux operating system is related to the dereferencing of a pointer with an expired validity period. Exploiting this vulnerability could allow an attacker to compromise the confidentialit...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Fixed a NULL pointer dereferencing in qcasetup, which occurred for non-serdev devices. For devices connected via non-serdev paths, hu-serdev is NULL. However, qcasetup serdevdevicegetdrvdatahu-serdev and...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

A race condition was detected in the Bluetooth device driver of the Linux kernel’s min,maxkeysizeset function. This can lead to a null pointer dereferencing issue, potentially causing a kernel panic or a denial-of-service attack...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A use-after-free flaw was discovered in btsdioremove in the drivers\bluetooth\btsdio.c file within the Linux kernel. In this flaw, calling btsdioremove with an unfinished job may lead to a race condition, resulting in a User Account Fault UAF on HDev devices...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

A race condition was detected in the Linux kernel’s net/bluetooth device driver, specifically in the conninfomin,maxageset function. This can lead to an integrity overflow issue, potentially causing abnormal Bluetooth connections or denial of service...

CVE-2026-74301

A flaw was found in the Linux kernel's Bluetooth driver. An error in handling Bluetooth packets can cause a memory leak, where a data structure is not properly released. This continuous leakage of memory could potentially lead to system instability or a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-74304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciqca: fix NULL pointer dereference in qcasetup for non-serdev device hu-serdev is NULL for hciuart attached via non-serdev paths, but qcasetup...

Linux Distros Unpatched Vulnerability : CVE-2026-74301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btmtk: fix URB leak in allocmtkintrurb error path When btmtkisopktpad fails, the previously allocated URB is not freed, leaking the urb structure. Ad...

CVE-2026-11894

The CVE-2026-11894 entry concerns Realtek’s BEE Bluetooth HCI driver (bt_hci_bee_send in drivers/bluetooth/hci/hci_bee.c). The vulnerability arises from violating the bt_hci_driver_api buffer-ownership contract: on error, the host should retain and unref the transmit net_buf, but the pre-fix code...

CVE-2026-11893 Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

CVE-2026-11893 Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

PT-2026-70060

Name of the Vulnerable Software and Affected Versions Realtek BEE Bluetooth HCI driver affected versions not specified Description The bt hci bee send function in drivers/bluetooth/hci/hci bee.c violates the buffer-ownership contract of the bt hci driver api. The driver incorrectly releases the...

CVE-2026-20495

In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296...

CVE-2026-20495

In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296...

EUVD-2026-52085

In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296...

CVE-2026-20495

CVE-2026-20495 involves a Bluetooth driver with a missing permission check that enables local escalation of privilege. The vulnerability could be exploited locally with low privileges and no user interaction, potentially compromising confidentiality, integrity, and availability. The documented re...

CVE-2026-64549

A flaw was found in the Linux kernel's Bluetooth bpa10x driver. This vulnerability allows a malicious Bluetooth device to trigger an out-of-bounds read in the bpa10xsetup function by sending a specially crafted one-byte or non-NUL-terminated response. This can lead to information disclosure, wher...

CVE-2026-64407

A flaw was found in the Linux kernel's Bluetooth driver. A malicious Bluetooth controller could send a specially crafted firmware download request that causes an out-of-bounds read. This allows the driver to read memory beyond the intended firmware data and send it back over the Universal...