CVE-2017-0541

poc and vulnerability analysis of CVE-2017-0541...

CVE-2026-98247

A flaw was found in the Linux kernel's Bluetooth subsystem. When processing responses for supported codecs, the parser fails to verify that adequate buffer space remains before reading the vendor codec count. A malicious or malfunctioning Bluetooth controller can supply a truncated response packe...

CVE-2026-98246

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition during Bluetooth device closure allows codec list cleanup to proceed without appropriate locking while a concurrent socket option query is reading codec entries. A local user can exploit this vulnerability to trigger a...

CVE-2026-98297

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when network transmission requests are queued while the Bluetooth device is being shut down and its background workqueue is draining. A local attacker could exploit this vulnerability by sending data through...

CVE-2026-98295

A flaw was found in the Linux kernel's Bluetooth subsystem. A local user can cause a Denial of Service DoS or memory corruption by disconnecting a Bluetooth device during an active diagnostic crash dump. Because the system fails to cancel pending dump tasks upon device unregistration, background...

CVE-2026-98293

A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local user or adjacent attacker to cause a Denial of Service DoS by triggering a resource leak. When handling Bluetooth Isochronous ISO connections, the kernel fails to release a reference to the parent socket if child...

USN-8905-2 linux-gcp vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - x86 architecture; - Intel NPU Driver; - Auxiliary...

ROS-20261006-73-0091

The vulnerability of the functions sessionfree, hidpsessionRemove, and hidpSessionThread in the net/bluetooth/hidp/core.c module of the Linux kernel’s Bluetooth subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a...

CVE-2026-90255

A flaw was found in the Linux kernel's Bluetooth subsystem. Specifically, a resource leak occurs in the handling of Synchronous Connection-Oriented SCO setup contexts. If a setup entry is cancelled, its associated context is not properly released, leading to a memory leak. This issue could also...

ROS-20261005-73-0037

The vulnerability of the l2capecredconnreq function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to a numerical overflow issue. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

CVE-2026-97975

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when child network devices are unregistered concurrently while Bluetooth connection cleanup routines reparent child devices. A local user can exploit this timing issue to trigger a NULL pointer dereference,...

CVE-2026-97408

A flaw was found in the Linux kernel's Bluetooth subsystem. The Logical Link Control and Adaptation Protocol L2CAP implementation fails to properly validate the payload length of connectionless frames before reading the Protocol/Service Multiplexer PSM field. An adjacent attacker within Bluetooth...

CVE-2026-98109

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs during device registration when background initialization tasks execute before internal structures and locks are fully prepared. A local user can trigger this issue during device setup, causing the system to attem...

CVE-2026-98108

A flaw was found in the Linux kernel's Bluetooth subsystem. When processing Bluetooth Low Energy connection requests in the Logical Link Control and Adaptation Protocol L2CAP layer, channel modes are incorrectly assigned during deferred connection handling. A nearby attacker within Bluetooth rang...

CVE-2026-98107

A flaw was found in the Linux kernel's Bluetooth subsystem. A local user can trigger an out-of-bounds memory write by establishing multiple concurrent Logical Link Control and Adaptation Protocol L2CAP connections. Due to improper channel limit verification, this flaw allows memory corruption tha...

ROS-20260928-73-0094

The vulnerability of the scosockkill function in the net/bluetooth/sco.c module of the Linux Bluetooth subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

ROS-20260928-73-0080

The vulnerability of the recvpkt function in the net/bluetooth/6lowpan.c module of the Linux Bluetooth subsystem is related to the improper disabling or release of resources. Exploiting this vulnerability could allow a malicious actor to cause service failure remotely...

ROS-20260925-73-0068

The vulnerability of the hidpsettimer function in the net/bluetooth/hidp/core.c module of the Linux kernel’s Bluetooth subsystem is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility...

kernel: Bluetooth: serialize accept_q access

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition exists in the handling of the acceptq within the btsockpoll function due to a lack of synchronization. This could allow a local attacker to cause a denial of service by manipulating socket operations during child teardow...

kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition in the hidpsessionthread can lead to a use-after-free vulnerability. This occurs when a timer is active while its deletion function is called, causing memory to be accessed after it has been freed. A local attacker could...