CVE-2025-21969 Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2capsendcmd After the hci sync command releases l2capconn, the hci receive data work queue references the released l2capconn when sending to the upper layer. Add hci dev lock to...

CVE-2025-21937 Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmtallocskb in mgmtremotename Add check for the return value of mgmtallocskb in mgmtremotename to prevent null pointer dereference...

CVE-2025-21937

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmtallocskb in mgmtremotename Add check for the return value of mgmtallocskb in mgmtremotename to prevent null pointer dereference...

CVE-2025-21936 Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmtallocskb in mgmtdeviceconnected Add check for the return value of mgmtallocskb in mgmtdeviceconnected to prevent null pointer dereference...

CVE-2025-21936

CVE-2025-21936 affects the Linux kernel Bluetooth subsystem. The vulnerability arises from not checking the return value of mgmt_alloc_skb() in mgmt_device_connected(), leading to a potential null pointer dereference. The connected Azure/Tenable Nessus entries reference the advisory and state tha...

CVE-2025-21936 Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmtallocskb in mgmtdeviceconnected Add check for the return value of mgmtallocskb in mgmtdeviceconnected to prevent null pointer dereference...

USN-7385-1 linux-ibm vulnerabilities

Michael Randrianantenaina discovered that the Bluetooth driver in the Linux Kernel contained an improper access control vulnerability. A nearby attacker could use this to connect a rougue device and possibly execute arbitrary code. CVE-2024-8805 Attila Szász discovered that the HFS+ file system...

CVE-2023-53017

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: fix memory leak in hciupdateadvdata When hcicmdsyncqueue failed in hciupdateadvdata, instptr is not freed, which will cause memory leak, convert to use ERRPTR/PTRERR to pass the instance to callback so no memo...

CVE-2023-53018

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix memory leaks When hcicmdsyncqueue failed in hcileterminatebig or hcilebigterminate, the memory pointed by variable d is not freed, which will cause memory leak. Add release process to error path...

CVE-2023-53016

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix possible deadlock in rfcommskstatechange syzbot reports a possible deadlock in rfcommskstatechange 1. While rfcommsockconnect acquires the sk lock and waits for the rfcomm lock, rfcommsockrelease could have the...

CVE-2022-49754

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix a buffer overflow in mgmtmeshadd Smatch Warning: net/bluetooth/mgmtutil.c:375 mgmtmeshadd error: memcpy 'meshtx-param' too small 48 vs 50 Analysis: 'meshtx-param' is array of size 48. This is the destination. u8...

CVE-2023-53017 Bluetooth: hci_sync: fix memory leak in hci_update_adv_data()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: fix memory leak in hciupdateadvdata When hcicmdsyncqueue failed in hciupdateadvdata, instptr is not freed, which will cause memory leak, convert to use ERRPTR/PTRERR to pass the instance to callback so no memo...

CVE-2023-53018

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix memory leaks When hcicmdsyncqueue failed in hcileterminatebig or hcilebigterminate, the memory pointed by variable d is not freed, which will cause memory leak. Add release process to error path...

CVE-2023-53018

CVE-2023-53018 affects the Linux kernel Bluetooth stack. If hci_cmd_sync_queue() fails in hci_le_terminate_big() or hci_le_big_terminate(), the memory pointed to by d is not freed, causing a memory leak. A patch adds a release path in the error flow to fix this. Exploitation details are not provi...

CVE-2023-53018 Bluetooth: hci_conn: Fix memory leaks

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix memory leaks When hcicmdsyncqueue failed in hcileterminatebig or hcilebigterminate, the memory pointed by variable d is not freed, which will cause memory leak. Add release process to error path...

CVE-2023-53018 Bluetooth: hci_conn: Fix memory leaks

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix memory leaks When hcicmdsyncqueue failed in hcileterminatebig or hcilebigterminate, the memory pointed by variable d is not freed, which will cause memory leak. Add release process to error path...

CVE-2023-53016 Bluetooth: Fix possible deadlock in rfcomm_sk_state_change

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix possible deadlock in rfcommskstatechange syzbot reports a possible deadlock in rfcommskstatechange 1. While rfcommsockconnect acquires the sk lock and waits for the rfcomm lock, rfcommsockrelease could have the...

CVE-2023-53016

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix possible deadlock in rfcommskstatechange syzbot reports a possible deadlock in rfcommskstatechange 1. While rfcommsockconnect acquires the sk lock and waits for the rfcomm lock, rfcommsockrelease could have the...

CVE-2023-53016

CVE-2023-53016 concerns a potential deadlock in the Linux kernel Bluetooth rfcomm path. The issue arises when rfcomm_sock_connect holds the sk lock while waiting for the rfcomm lock, and rfcomm_sock_release may hold the rfcomm lock and attempt to acquire the sk lock, creating a deadlock scenario....

CVE-2022-49754

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix a buffer overflow in mgmtmeshadd Smatch Warning: net/bluetooth/mgmtutil.c:375 mgmtmeshadd error: memcpy 'meshtx-param' too small 48 vs 50 Analysis: 'meshtx-param' is array of size 48. This is the destination. u8...