CVE-2020-0022

CVE-2020-0022 看起来 Android 9-6 具有相似的蓝牙子系统，Android 5 和 4 则不同。 Android 9.0 BlueFrag 实验 补丁： https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf 下面我触发了已修补的条件。好的，我想我搞定了，但不知何故我无法使进程崩溃。 嗯嗯嗯 实际上，成功将带符号的长度值传给了 memcpy 02-16 01:44:49.096 6423 6471 W...

esp32-cve-2025-27840-power-trace-experiment

esp32-cve-2025-27840-power-trace-experiment Firmware para obtener una traza de potencia del comportamiento del módulo bluetooth en el ESP32 cuando se le envían los comandos hci de bluetooth no documentados CVE-2025-27840. Cuando el ESP32 recibe los comandos, alterna un pin GPIO para disparar la...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syst...

Oracle Linux 10 : ELSA-2026-63128-0: / kernel (ELSA-2026-631280)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-631280 advisory. - net: ipv6: clear suppressed fib6 rule result Jamie Bainbridge RHEL-246368 CVE-2026-74581 - iomap: fix out-of-bounds bitmapset with zero-length ran...

SUSE CVE-2026-80763

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

AZL-99486 CVE-2026-80762 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...

AZL-99654 CVE-2026-80763 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

AZL-99575 CVE-2026-80764 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80764

CVE-2026-80764 affects the Linux kernel Bluetooth subsystem. The vulnerability is a use-after-free (UAF) in the HCI event handler: hci_cc_reset() clears the LE accept and resolving lists without acquiring hdev->lock , while debugfs readers (e.g., white_list_show) hold that lock while traversin...

EUVD-2026-71407

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80764 Bluetooth: hci_event: fix LE list UAF on reset

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

EUVD-2026-71406

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

CVE-2026-80763

CVE-2026-80763 is an out-of-bounds read in the Linux kernel Bluetooth HCI subsystem. In hci_cc_le_set_cig_params(), the handler trusts the num_handles field of the LE Set CIG Parameters Command Complete response and reads the trailing handle array without verifying that the remaining skb data act...

CVE-2026-80763 Bluetooth: hci_event: validate LE Set CIG Parameters response

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

CVE-2026-80762

CVE-2026-80762 is a use-after-free in the Linux kernel Bluetooth HCI subsystem (hci_sync). The function hci_update_event_filter_sync() walks the device's accept list while issuing synchronous HCI commands per remote-wakeup device. The suspend path holds hdev->req_lock, but accept-list mutation...

kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...

kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...

kernel security update

6.12.0-211.51.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Linux Distros Unpatched Vulnerability : CVE-2026-80762

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each...

SUSE CVE-2026-80692

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...