197 matches found
PT-2026-146863
The AVRCP browsing channel's L2CAP receive-buffer callback, browsing avrcp l2cap alloc buf in subsys/bluetooth/host/classic/avrcp.c, allocated from the shared avctp browsing rx pool with K FOREVER. L2CAP invokes that callback from the Bluetooth RX work queue thread bt workq, "BT RX WQ", both for...
CVE-2026-90832
bthcileperadvreportcommon in subsys/bluetooth/host/scan.c handles the HCILEPeriodicAdvertisingReport and v2 event. It verified that the fixed event header was present and that the controller-declared DataLength fits the tailroom of the periodic-sync reassembly buffer, but never checked that the...
CVE-2026-90832 Out-of-bounds read in Bluetooth Host periodic advertising report reassembly due to unvalidated report length
bthcileperadvreportcommon in subsys/bluetooth/host/scan.c handles the HCILEPeriodicAdvertisingReport and v2 event. It verified that the fixed event header was present and that the controller-declared DataLength fits the tailroom of the periodic-sync reassembly buffer, but never checked that the...
CVE-2026-90832
The Zephyr RTOS Bluetooth host stack contains an out-of-bounds read in bt_hci_le_per_adv_report_common() within subsys/bluetooth/host/scan.c. The vulnerability occurs because the system fails to verify that the HCI_LE_Periodic_Advertising_Report (and _v2) event carries as many data bytes as the e...
CVE-2026-90832 Out-of-bounds read in Bluetooth Host periodic advertising report reassembly due to unvalidated report length
bthcileperadvreportcommon in subsys/bluetooth/host/scan.c handles the HCILEPeriodicAdvertisingReport and v2 event. It verified that the fixed event header was present and that the controller-declared DataLength fits the tailroom of the periodic-sync reassembly buffer, but never checked that the...
CVE-2026-90832
bthcileperadvreportcommon in subsys/bluetooth/host/scan.c handles the HCILEPeriodicAdvertisingReport and v2 event. It verified that the fixed event header was present and that the controller-declared DataLength fits the tailroom of the periodic-sync reassembly buffer, but never checked that the...
PT-2026-144852
Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description An issue exists in the bt hci le per adv report common function within subsys/bluetooth/host/scan.c when handling HCI LE Periodic Advertising Report and HCI LE Periodic Advertising Report v2...
CVE-2026-85034
The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to btgattsubscribeparams::notify callbacks using only the length derived from the received ATT PDU. btattrecv in subsys/bluetooth/host/att.c...
CVE-2026-85033
The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...
CVE-2026-85034
The Zephyr RTOS Bluetooth host's GATT client is vulnerable to an out-of-bounds write when processing Handle Value Notifications , Indications , or Multiple Handle Value Notifications . The root cause is that bt_att_recv() fails to enforce the negotiated ATT MTU, and the L2CAP channel lacks an rx....
EUVD-2026-115822
The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to btgattsubscribeparams::notify callbacks using only the length derived from the received ATT PDU. btattrecv in subsys/bluetooth/host/att.c...
CVE-2026-85034 Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers
The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to btgattsubscribeparams::notify callbacks using only the length derived from the received ATT PDU. btattrecv in subsys/bluetooth/host/att.c...
EUVD-2026-115821
The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...
Linux Distros Unpatched Vulnerability : CVE-2026-81039
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Bluetooth host pre-allocates a btconn object a reservation from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddcon...
Linux Distros Unpatched Vulnerability : CVE-2026-82388
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by...
CVE-2026-81039
The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...
CVE-2026-81039
The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...
UBUNTU-CVE-2026-81039
The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...
EUVD-2026-109971
The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...
PT-2026-123418
The Bluetooth host pre-allocates a bt conn object a "reservation" from the fixed acl conns pool for every connectable advertising set it starts, in le adv start add conn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, find pending connect in...