CVE-2026-28623: Missing Authorization

In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

kernel security, bug fix, and enhancement update

5.14.0-687.44.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

CVE-2026-79378: Uncontrolled Resource Consumption

An issue in the btmaclhandle function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service DoS via sending a crafted L2CAP packet...

PT-2026-87435

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

PT-2026-87075

Name of the Vulnerable Software and Affected Versions Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware versions prior to 5.0 Description A buffer overflow occurs in the SBC DecodeFrames function. This issue allows attackers to cause a Denial of Service DoS by sending a crafted frame. A...

EUVD-2026-72779

A buffer overflow in the SBCDecodeFrames function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier and fixed in v.5.0 allows attackers to cause a Denial of Service DoS via sending a crafted frame...

ROS-20260908-73-0078

The vulnerability of the Bluetooth component in Google Chrome browser relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a specially created HTML page...

RHEL 10 : kernel (RHSA-2026:65334)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65334 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: nSVM: Always use vmcb01...

Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability

Overview Skullcandy Dime 3 wireless earbuds, running firmware version 1.0.0.28, accept a new Bluetooth Classic BR/EDR pairing request from an unpaired device without requiring the earbuds to be placed into pairing mode or requiring any physical confirmation or interaction from the owner...

CVE-2026-69448: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

SUSE CVE-2026-80762

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix accept list UAF during suspend hciupdateeventfiltersync walks hdev-acceptlist while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev-reqlock, but accept-list...

SUSE CVE-2026-80764

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-14297

A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service CGMS Record Access Control Point RACP write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on...

USN-8729-1 linux, linux-fips, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-raspi, linux-realtime, linux-realtime-6.8 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - PowerPC architecture; - Compute Acceleration Framework; - Drivers core;...

CVE-2026-14297

CVE-2026-14297 is a buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler of Nordic Semiconductor Struct SA . The vulnerable code memcpys the entire attacker-supplied ATT write value into a fixed 20-byte static BSS buffer , ...

CVE-2026-14297: Out-of-bounds Write

A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service CGMS Record Access Control Point RACP write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on...

Ubuntu 22.04 LTS / 24.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Linux kernel vulnerabilities (USN-8729-1)

"The remote Ubuntu 22.04 LTS / 24.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8729-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly us...

TencentOS Server 4: bluez (TSSA-2026:0960)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0960 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-80759

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciaml: validate firmware segment lengths amldownloadfirmware reads two lengths from the firmware header and uses them to build pointers before...

Linux Distros Unpatched Vulnerability : CVE-2026-80760

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it...