CVE-2026-64470

A flaw was found in the Linux kernel's Bluetooth USB btusb driver. This vulnerability occurs during the Marvell Out-Of-Band OOB wakeup configuration when a probe failure happens. An attacker could potentially exploit a use-after-free condition in the completion callback, which may lead to system...

EUVD-2026-48814

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback. This issue...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: btusb: Added a NULL check for “date-evtskb”. Fixed a crash due to NULL pointers. 6104.969662 BUG: NULL pointer dereferencing in the kernel; address: 00000000000000c8 6104.969667 PF: Supervisor read access in kernel...

CVE-2026-31497

A flaw was found in the Linux kernel's Bluetooth USB btusb driver. An attacker with control over Bluetooth connections could trigger an out-of-bounds read in the btusbwork function. This occurs because the function, which maps active Synchronous Connection-Oriented SCO links to USB alternate...

CVE-2026-31497

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: clamp SCO altsetting table indices btusbwork maps the number of active SCO links to USB alternate settings through a three-entry lookup table when CVSD traffic uses transparent voice settings. The lookup current...

Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF

...

CVE-2025-40283

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: reorder cleanup in btusbdisconnect to avoid UAF There is a KASAN: slab-use-after-free read in btusbdisconnect. Calling "usbdriverreleaseinterface&btusbdriver, data-intf" will free the btusb data associated with...

EUVD-2013-5006

Malware in sbrugna...

CVE-2025-38641

The CVE-2025-38641 issue concerns the Linux kernel Bluetooth subsystem (btusb). A NULL pointer dereference could occur on kmalloc failure because the return value wasn’t properly checked, leading to unsafe dereference in the affected code path. The connected documents state the fix as: validate t...

CVE-2013-5166

The Bluetooth USB host controller in Apple Mac OS X before 10.9 prematurely deletes interfaces, which allows local users to cause a denial of service system crash via a crafted application...

UBUNTU-CVE-2025-37918

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: avoid NULL pointer dereference in skbdequeue A NULL pointer dereference can occur in skbdequeue when processing a QCA firmware crash dump on WCN7851 0489:e0f3. 93.672166 Bluetooth: hci0: ACL memdump size589824...

The vulnerability of the btusb component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the btusb component in the Linux operating system’s kernel is related to the assignment of the NULL pointer in the btusbmtkhciwmtsync function. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE CVE-2024-26887

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix memory leak This checks if CONFIGDEVCOREDUMP is enabled before attempting to clone the skb and also make sure btmtkprocesscoredump frees the skb passed following the same logic...

CVE-2013-5166

The Bluetooth USB host controller in Apple Mac OS X before 10.9 prematurely deletes interfaces, which allows local users to cause a denial of service system crash via a crafted application...

CVE-2013-5166

The Bluetooth USB host controller in Apple Mac OS X before 10.9 prematurely deletes interfaces, which allows local users to cause a denial of service system crash via a crafted application...

Unbreakable Enterprise kernel Security update

2.6.39-400.21.2 - KVM: x86: Convert MSRKVMSYSTEMTIME to use gfntohvacache functions CVE-2013-1797 Andy Honig Orabug: 16711660 CVE-2013-1797 - Bluetooth: Fix incorrect strncpy in hidpsetuphid Anderson Lizardo Orabug: 16711065 CVE-2013-0349 - USB: ioti: Fix NULL dereference in chaseport Wolfgang...