CVE-2026-98730

A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. A local user with access to the Bluetooth Host Controller Interface HCI user channel can inject an oversized transmission packet. Because the driver fails to validate packet length before copying data into a fixed-size memory...

CVE-2026-19940: Use After Free

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...

CVE-2026-19939: Expired Pointer Dereference

The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...

CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19935 Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown

The Bluetooth LE host queues received L2CAP connection-oriented channel CoC data for deferred processing through a struct kwork embedded in the channel object lechan-rxwork, handler l2caprxprocess whenever the channel uses a dynamic PSM 0x0080-0x00FF. Channel teardown in l2capchandestroy in...

CVE-2026-19935

The Zephyr Bluetooth host is vulnerable to a use-after-free flaw in the L2CAP connection-oriented channel (CoC) object. When using a dynamic PSM (0x0080-0x00FF), the system queues received data for deferred processing via a k_work item. However, during channel teardown in l2cap_chan_destroy(), th...

CVE-2026-19935 Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown

The Bluetooth LE host queues received L2CAP connection-oriented channel CoC data for deferred processing through a struct kwork embedded in the channel object lechan-rxwork, handler l2caprxprocess whenever the channel uses a dynamic PSM 0x0080-0x00FF. Channel teardown in l2capchandestroy in...

EUVD-2026-58131

The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...

EUVD-2026-55575

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Clear memdump state on invalid dump size qcacontrollermemdump allocates qca-qcamemdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active,...

EUVD-2026-55266

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciuart: clear HCIUARTSENDING when writework is canceled HCIUARTSENDING bit in txstate means writework is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hciuartclose,...

CVE-2026-24076 Buffer Copy Without Checking Size of Input in Bluetooth HOST

Memory Corruption when processing registry values with incorrect types using a direct query method...

CVE-2026-24076 Buffer Copy Without Checking Size of Input in Bluetooth HOST

Memory Corruption when processing registry values with incorrect types using a direct query method...

CVE-2026-11368: Use After Free

The Bluetooth host ATT layer subsys/bluetooth/host/att.c associates each in-flight ATT TX buffer with its owning channel via the static txmetadatastorage array data-attchan = chan. When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system...

PT-2026-67714

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A use-after-free issue exists in the Bluetooth host ATT layer within the subsys/bluetooth/host/att.c file. The system associates in-flight ATT TX buffers with...

CVE-2026-2411: Incorrect Authorization

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...

PT-2026-67194

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description Zephyr's Bluetooth host incorrectly handles security permission checks when sending notifications or indications. When a Characteristic Declaration attribute is used, the host evaluates the...

CVE-2026-64405

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL while reqstatus is still HCIREQPEND, leading to a NULL pointer dereferen...

CVE-2026-53073

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...

CVE-2026-53252

The CVE-2026-53252 affects the Linux kernel Bluetooth HCI path. Root cause: memory leak of SRCU percpu memory when device init fails before hci_register_dev(), due to not cleaning up the SRCU struct on the unregistered fallback path. Fix: call cleanup_srcu_struct() in bt_host_release() fallback b...