CVE-2026-98457

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP implementation. An adjacent attacker within Bluetooth range could exploit this vulnerability by transmitting specially crafted, undersized network frames. Because the kernel fails to validate packe...

CVE-2017-0541

poc and vulnerability analysis of CVE-2017-0541...

CVE-2014-0224

This repository does not have a README...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Validating the PDU length before reading the SDU length in l2capecreddatarcv The l2capecreddatarcv function reads the SDU length field from skb-data using getunalignedle16, without first verifying that skb...

CVE-2022-39227

This repo belongs to https://github.com/user0x1337/CVE-2022-39227 I just copy it...

CVE-2026-90256

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A use-after-free UAF vulnerability can occur when hciconn::l2capdata is accessed without proper locking during the disconnection indication process. This can lead to a system crash or...

CVE-2026-90093

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. This vulnerability allows for a Use-After-Free UAF condition when handling getsockopt and setsockopt operations. An attacker could exploit this by causing the system to attempt to access...

CVE-2026-90092

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol implementation. A race condition can occur when a new connection is established while a parent L2CAP channel is being torn down, due to inconsistent locking. This can lead to a Use-After-Free UAF...

CVE-2026-90091

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A race condition, a situation where multiple operations occur at the same time and interfere with each other, exists between internal functions. This can lead to a null pointer...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Fixed type confusion in l2capecredreconfrsp The function l2capecredreconfrsp casts the incoming data into the struct l2capecredconnrsp an ECRED connection response, 8 bytes long, with the result at offset 6,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP – Fixed issue where multiple L2CAPECREDCONNREQUESTs were accepted. Currently, the code attempts to accept requests regardless of the command identifier. This can result in multiple requests being marked as pendin...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Verify the payload length of L2CAPINFORSP before performing the read operation. The l2capinformationrsp function checks that cmdlen covers the fixed l2capinforsp header type + result, 4 bytes. However, it the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Cancel pendingrxwork before taking conn-lock The l2capconndel function takes conn-lock and then calls cancelworksync for pendingrxwork. processPendingRx uses the same mutex, so deadlock can occur when tearing do...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Fixed null-ptr-deref in l2capsockresumecb. syzbot reported null-ptr-deref in l2capsockresumecb. 0 l2capsockresumecb has a similar issue that was fixed in commit 1bff51ea59a9 “Bluetooth: fixed use-after-free errors i...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Fixed “use-after-free” issue This involves using l2capchanholdunlesszero after calling l2capgetchanblah to prevent the following issue: Bluetooth: l2capcore.c: static void l2capchandestroystruct krefkref...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2024_10281)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202410281 advisory. kernel: media: edia: dvbdev: fix a use-after-free CVE-2024-27043 kernel: Bluetooth: l2cap: fix null-ptr-deref in l2capchantimeout CVE-2024-27399 kernel:...

CVE-2026-98108 Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...

kernel: Bluetooth: L2CAP: Fix potential user-after-free

A use-after-free flaw was identified in the Linux kernel’s Bluetooth L2CAP implementation. In certain conditions, when allocating a socket buffer via allocskb, the kernel may release and later reacquire the channel lock; if the channel is disconnected in the meantime, a subsequent reference to th...

kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

A flaw was found in the Bluetooth L2CAP Logical Link Control and Adaptation Protocol component of the Linux kernel. When a device receives a connection response with an already-assigned destination Channel Identifier CID, the system may crash. This occurs because the kernel's procedure for...

kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

A flaw was found in the Bluetooth L2CAP Logical Link Control and Adaptation Protocol component of the Linux kernel. When a device receives a connection response with an already-assigned destination Channel Identifier CID, the system may crash. This occurs because the kernel's procedure for...