CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: Proper handling of “hold” state in “isoconnready”. The dereferencing of “sk” in “isoconnready” must be done either under “conn-lock” or while holding the reference count, to avoid concurrent closure. Currently,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: holding the connection in the hciconnectbigsync callback. There is a theoretical use-after-free vulnerability if the connection is freed while the hcisync task is running. The issue is mitigated by keeping tra...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. The issue was fixed by adding the lock/release mechanism...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: The connection reference is held during the abortconnsync function call. There is a theoretical use-after-free vulnerability if the connection is freed while the hcisync task is running. To avoid this issue, t...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Fixed a NULL pointer dereferencing in qcasetup, which occurred for non-serdev devices. For devices connected via non-serdev paths, hu-serdev is NULL. However, qcasetup serdevdevicegetdrvdatahu-serdev and...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: Clearing the isodata field always when detaching the conn field from the hcon field. When setting conn-hcon = NULL, it is also necessary to set conn-hcon-isodata = NULL. Otherwise, the subsequent call to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: avoiding deadlocks in isosocktimeout The isosocktimeout function takes locksock, so disabling the timer while holding that lock may lead to a deadlock. isosocktimeout may also run concurrently with isoconndel,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: In the ISO section, there was a issue where references to the socket would leak after the socket is released. The function isosockkill checks whether !sockflagsk, SOCKZAPPED is true, and also checks whether...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hci: validate codec capability element length The hcireadcodeccapabilities function returns a sequence of capability elements. Each element begins with a one-byte length, followed by that many payload bytes...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hciqca – Fixed a NULL pointer dereferencing in qcadmphdr, for devices that are not serdev devices. For devices connected via non-serdev paths, hu-serdev is NULL. However, qcadmphdr dereferences...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: refactoring the malicious adv data check The issue of out-of-bound reads was being performed at the end of the while loop for numreports. This could lead to false positives being recorded in the journal. A check was...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: btmtk: fixed the URB leak in the allocmtkintrurb error path When btmtkisopktpad fails, the previously allocated URB is not freed, causing the urb structure to leak. Add usbfreeurb before returning the error...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Avoid use-after-free in dbg for hciremoveadvmonitor KASAN reports that there’s a use-after-free in hciremoveadvmonitor. By examining the disassembly, it can be seen that the issue arises from the access in...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: “Bluetooth: btsdio: fix use after free bug in btsdioRemove due to unfinished work” This issue has been resolved through commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. This patch may introduce a potential null-ptr-def problem...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: Fixed issues related to locking and validity checks for isoconn. sk-skstate indicates whether isopisk-conn is valid. Operations that check or update skstate and access conn should hold locksock; otherwise, they...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Use RCU for hciconnparams and iterate safely in hcisync. hciupdateacceptlistsync iterates over hdev-pendleconns and hdev-pendlereports, and waits for controller events within the loop body, without holding the hdev...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-6.1, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fixed handling of HCIEVIOCAPAREQUEST. If we receive HCIEVIOCAPAREQUEST while HCIOPREADREMOTEEXTFEATURES has not yet been responded to, assume that the remote supports SSP. Otherwise, this event should not be...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel – Validated the length before parsing diagnostic TLVs. The btinteldiagnostics function accesses tlv-val0 without first verifying that the diagnostic VSE is long enough to contain that field. This may lead to...