CVE-2017-0541

poc and vulnerability analysis of CVE-2017-0541...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-8968-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8968-1 advisory. It was discovered that the Bluetooth subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a...

Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerabilities (USN-8966-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8966-1 advisory. Jrgen Gro discovered that the Xen network backend driver in the Linux kernel did not adequately limit the amount of queued packets when a gue...

USN-8968-1 linux vulnerabilities

It was discovered that the Bluetooth subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2021-3640 Several security issues were discovered in the Linux kernel. An...

USN-8968-1: Linux kernel vulnerabilities

It was discovered that the Bluetooth subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2021-3640 Several security issues were discovered in the Linux kernel. An...

USN-8966-1: Linux kernel vulnerabilities

Jürgen Groß discovered that the Xen network backend driver in the Linux kernel did not adequately limit the amount of queued packets when a guest did not process them. An attacker in a guest VM can use this to cause a denial of service excessive kernel memory consumption in the network backend...

USN-8966-1 linux, linux-aws, linux-fips, linux-kvm, linux-lts-xenial vulnerabilities

Jürgen Groß discovered that the Xen network backend driver in the Linux kernel did not adequately limit the amount of queued packets when a guest did not process them. An attacker in a guest VM can use this to cause a denial of service excessive kernel memory consumption in the network backend...

CVE-2026-99091

A flaw was found in the Linux kernel's Bluetooth subsystem. When pending management commands are flushed during an adapter power-off or device removal event, the kernel incorrectly reports command status values using internal memory pointer data instead of the intended error code. A local user ca...

CVE-2026-80763

A flaw was found in the Linux kernel's Bluetooth subsystem. A malicious or malfunctioning Bluetooth controller could send a specially crafted, truncated response to a command. This could lead to the kernel attempting to read beyond an allocated memory buffer, potentially causing a system crash...

CVE-2026-99014

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition between concurrent worker threads during Periodic Advertising PA sync scan setup can cause a command buffer to be freed while still in use. A local attacker could exploit this use-after-free flaw to cause a Denial of...

CVE-2026-99015

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can exploit this flaw to cause a Denial of Service DoS by crashing the system. Due to missing lock synchronization when rebinding a Host Controller Interface HCI socket after a controller is unregistered, a race conditio...

CVE-2026-99012

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can cause a Denial of Service DoS by issuing concurrent connection requests on Bluetooth isochronous ISO sockets. Due to improper locking and lack of serialization during connection establishment, simultaneous connect...

CVE-2026-99011

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition between connection termination and incoming data handling in the Synchronous Connection-Oriented SCO protocol can lead to a use-after-free condition. An attacker within Bluetooth range or a local user could exploit this...

CVE-2026-99013

A flaw was found in the Linux kernel's Bluetooth subsystem. A local user could cause a Denial of Service DoS due to a race condition during concurrent setup of Broadcast Isochronous Stream BIS socket listeners. By issuing simultaneous listen calls on the same broadcast socket, an attacker can...

CVE-2026-80762

A flaw was found in the Bluetooth subsystem of the Linux kernel. During the system suspend process, a timing issue can occur where the hciupdateeventfiltersync function attempts to access memory that has already been released. This Use-After-Free UAF vulnerability could allow a local attacker to...

CVE-2023-7356

A flaw was found in the Linux kernel's Bluetooth subsystem. An adjacent attacker within Bluetooth range could exploit this flaw by broadcasting specially crafted Bluetooth Low Energy LE periodic advertisement packets. Because incoming advertisement data was copied into internal socket buffers...

CVE-2026-98809

A flaw was found in the Linux kernel's Bluetooth subsystem. When unregistering a Bluetooth device, pending synchronous commands are processed without reaching the controller, causing each queued request to wait for a full timeout. A local user can exploit this issue by queuing an unbounded number...

CVE-2026-80764

A flaw was found in the Linux kernel's Bluetooth subsystem. A local user could exploit a use-after-free vulnerability in the hcievent component. This occurs when the hciccreset function clears Bluetooth Low Energy LE lists without proper locking, allowing a debugfs reader to access freed memory...

CVE-2026-98736

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs during enhanced Synchronous Connection-Oriented SCO link setup due to missing locking when accessing parent connection structures. A local user or adjacent attacker could exploit this timing window by concurrently...

CVE-2026-98735

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when outgoing network packets are scheduled while the associated communication channel is concurrently closed and freed during connection teardown. A local attacker could exploit this flaw to trigger a...