CVE-2023-7356

A flaw was found in the Linux kernel's Bluetooth subsystem. An adjacent attacker within Bluetooth range could exploit this flaw by broadcasting specially crafted Bluetooth Low Energy LE periodic advertisement packets. Because incoming advertisement data was copied into internal socket buffers...

CVE-2026-98809

A flaw was found in the Linux kernel's Bluetooth subsystem. When unregistering a Bluetooth device, pending synchronous commands are processed without reaching the controller, causing each queued request to wait for a full timeout. A local user can exploit this issue by queuing an unbounded number...

CVE-2026-98736

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs during enhanced Synchronous Connection-Oriented SCO link setup due to missing locking when accessing parent connection structures. A local user or adjacent attacker could exploit this timing window by concurrently...

CVE-2026-98735

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when outgoing network packets are scheduled while the associated communication channel is concurrently closed and freed during connection teardown. A local attacker could exploit this flaw to trigger a...

CVE-2026-98734

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker could exploit this flaw to cause a Denial of Service DoS via a system crash or potentially escalate privileges. The vulnerability occurs due to improper synchronization between packet transmission scheduling and connecti...

CVE-2026-98632

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can trigger a use-after-free condition by cancelling a pending Bluetooth mesh transmission while it remains queued for processing. When the system later attempts to handle the queued transmission using the already freed...

CVE-2026-93247

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can cause a Denial of Service DoS due to a race condition in the service discovery management code. Under specific timing conditions, clearing discovery filters concurrently with starting service discovery leaves interna...

CVE-2026-98738

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when the Security Manager Protocol SMP accesses remote Out-of-Band OOB pairing data without proper locking while the data is concurrently being removed. A local attacker can exploit this flaw to trigger a...

CVE-2026-98737

A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local user to cause a Denial of Service DoS or potentially escalate privileges due to a use-after-free condition. The issue arises from a race condition where synchronous command routines access inquiry cache entries...

CVE-2026-98733

A flaw was found in the Linux kernel's Bluetooth subsystem. Inadequate synchronization when handling fragmented isochronous ISO data packets allows a race condition between packet queueing and transmission operations. A local user could exploit this flaw to trigger a use-after-free condition,...

CVE-2026-93209

A flaw was found in the Linux kernel's Bluetooth subsystem. Under conditions of memory pressure, a function responsible for handling Bluetooth commands can fail to properly track command completion. This can lead to intermittent failures when enabling Bluetooth, resulting in a denial of service...

CVE-2017-0541

poc and vulnerability analysis of CVE-2017-0541...

CVE-2026-98458

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can cause a Denial of Service DoS through a reference count leak during Bluetooth Isochronous ISO channel attachment. When a socket attempts to attach to a channel that is already connected or in use by another socket, t...

CVE-2026-98461

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability can lead to a Denial of Service DoS due to an out-of-bounds memory read. The issue occurs when the Host Controller Interface HCI socket implementation filters event packets without verifying that the packet buffer is...

CVE-2026-98460

A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local, unprivileged user to bypass security restrictions and send unauthorized commands directly to the Bluetooth hardware. The vulnerability exists because the Host Controller Interface HCI raw socket improperly filte...

CVE-2026-98462

A flaw was found in the Linux kernel's Bluetooth subsystem. Improper reference count management during the reuse and binding of Connected Isochronous Stream CIS connections can result in an unbalanced connection hold count. A local attacker could exploit this flaw by triggering specific connectio...

CVE-2026-98459

A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local user to cause a Denial of Service DoS due to improper reference counting when handling Broadcast Isochronous Stream BIS connections. During unlinking operations, the kernel may prematurely release an active paren...

CVE-2026-98456

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition in the readunconfindexlist function allows a local user to cause an out-of-bounds write during asynchronous controller setup. This issue occurs when device state flags change between response buffer sizing and data...

Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerabilities (USN-8923-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8923-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update...

USN-8924-1 linux vulnerabilities

It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real PID value while inside a PID namespace. A local attacker could use this to expose sensitive information. CVE-2017-5967 Wen Xu discovered that the XFS file system implementation in the Linux...