CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom

CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom A Bluetooth Classic RFCOMM service of Parani M10 Intercom is exposed without enforcing secure authentication or proper access control. Once within range, any device can Establish a connection without proper...

CVE-2025-13834-A-Bluetooth-RFCOMM-Out-of-Bounds-Read-Vulnerability-in-Modern-Wireless-Devices

= doi.org/10.5281/zenodo.18323302 = orcid.org/0009-0007-7728-256X README.md: CVE-2025-13834 RFCOMM Bluetooth "Heartbleed" Exploitation Framework Author: Sastra Adi Wiguna Purple Elite Teaming Date: January 20, 2026 Version: 1.0 Full-System Replication License: RED TEAM USE ONLY Do not distribute...

RLSA-2026:70498 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - Disallow concurrent writes in afalgsendmsg CVE-2025-39964 kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry CVE-2026-45894 kernel: crypto: ccp - Fix a...

kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A race condition in the rfcommttysettermios function allows a session to be freed while it is still actively in use. This use-after-free UAF vulnerability can be exploited by a local attacker. Successful exploitation leads to a...

kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A race condition in the rfcommttysettermios function allows a session to be freed while it is still actively in use. This use-after-free UAF vulnerability can be exploited by a local attacker. Successful exploitation leads to a...

kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A race condition in the rfcommttysettermios function allows a session to be freed while it is still actively in use. This use-after-free UAF vulnerability can be exploited by a local attacker. Successful exploitation leads to a...

kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A race condition in the rfcommttysettermios function allows a session to be freed while it is still actively in use. This use-after-free UAF vulnerability can be exploited by a local attacker. Successful exploitation leads to a...

kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A malicious remote device could exploit this vulnerability by sending specially crafted, truncated Multiplexing Control Channel MCC frames. This lack of proper validation of incoming data length befor...

PT-2026-94436

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth RFCOMM component where the rfcomm apply pn function accepts a Maximum Transmission Unit MTU value from a remote Parameter Negotiation PN frame without...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

A NULL pointer dereference vulnerability exists in the Linux kernel on Linux, x86, and ARM platforms including networking and Bluetooth modules. This vulnerability is related to the /net/bluetooth/rfcomm/core.C file. This issue affects the Linux kernel version v2.6.12-rc2...

kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A malicious remote device could exploit this vulnerability by sending specially crafted, truncated Multiplexing Control Channel MCC frames. This lack of proper validation of incoming data length befor...

kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A race condition in the rfcommconnectind function, specifically during the handling of listener sockets, can lead to a use-after-free vulnerability. A local attacker could exploit this to cause a deni...

Linux Distros Unpatched Vulnerability : CVE-2026-89569

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding...

CVE-2026-89569

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. This vulnerability arises because the system does not properly manage memory when handling Bluetooth security confirmations. A race condition allows a part of the system to free memory that is still in use by another part, leading...

CVE-2026-89569

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

AZL-100721 CVE-2026-89569 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

DEBIAN-CVE-2026-89569

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

CVE-2026-89569

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

CVE-2026-89569 Bluetooth: RFCOMM: serialize security confirmation handling

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

EUVD-2026-76480

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...