Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: qca – fixed an issue where information was leaked when retrieving the board ID. A missing sanity check was added when retrieving the board ID to prevent the leakage of slab data when later requesting the firmware...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: holding the connection during the hcipastsync callback. This issue avoids handing over freed pointers to hciconnvalid, which might have been reused by kmalloc...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: fixed the “bad unlock balance” issue in l2capdisconnectrsp. The conn-chanlock is not acquired before l2capgetchanbyscid. If l2capgetchanbyscid returns NULL, then the “bad unlock balance” issue will be trigger...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: holding the connection during the hciconnectpasync callback There is a theoretical use-after-free vulnerability if the connection is freed while the hcisync task is running. Holding the reference count prevent...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcisync: Fixed UAFs related to advertising data. The hcifindadvinstance function returns a advinfo pointer that is only valid while hdev-lock is held. In the advertising command-sync path, instance lookups are...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Avoid leaving a dangling sk pointer in rfcommsockalloc The btsockalloc function attaches the allocated sk object to the provided sock object. If rfcommdlcalloc fails, we release the sk object, but leave a...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: fixed improper handling of malformed ISOEND/CONT packets. The Core Specification Part C, Volume 4, Section 5.4.5 does not exclude empty ISOCONT and ISOEND packets. Currently, we reject such packets if they are...

CVE-2026-78306

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

CVE-2026-78306 DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

CVE-2026-78306 DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

EUVD-2026-64752

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

CVE-2026-78306

DJI drones expose an unauthenticated DUML command interface over Bluetooth , allowing an attacker within Bluetooth range to modify Wi-Fi configuration parameters (SSID, PSK, MAC, regulatory country code, channel). By overwriting the Wi-Fi PSK with a known value, an attacker can connect to the dro...

CVE-2026-13213: NULL Pointer Dereference

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-78306: Missing Authentication for Critical Function

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the...

PT-2026-80937

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT CONN CB DEFINE, so security changed runs for every connection that establishes security even before the application has called bt has register. The service attribut...

PT-2026-79838

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

A Study of Bluetooth Access Control Based on NFT Soft Pairing

This paper proposes a Non-Fungible Token NFT soft pairing framework for Bluetooth service access control. Unlike conventional Bluetooth systems where pairing implicitly grants persistent service access, the proposed approach decouples native Bluetooth pairing from authorization without modifying...

CVE-2016-0137

creationtimestamp| type| source ---|---|--- 2026-08-22 14:00:18+00:00| seen| https://t.me/informationsec/1328 2026-08-23 00:00:36+00:00| seen| https://t.me/informationsec/1328...

[SECURITY] Fedora 44 Update: bluez-5.87-4.fc44

Utilities for use in Bluetooth applications: - avinfo - bluemoon - bluetoothctl - bluetoothd - btattach - btmon - hex2hcd - mpris-proxy The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A...