Linux kernel Bluetooth L2CAP Buffer Overflow

The vulnerability of the l2capinformationrsp function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

Linux kernel Bluetooth mgmt_add_adv_patterns_monitorComplete() Data Compromise

The vulnerability of the mgmtaddadvpatternsmonitorComplete function in the net/bluetooth/mgmt.c module of the Linux kernel’s Bluetooth subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

PT-2026-81896

Name of the Vulnerable Software and Affected Versions BlueZ affected versions not specified Description A stack-based buffer overflow occurs in the Linux Bluetooth protocol stack when processing an Extended Inquiry Response EIR packet. A remote attacker within Bluetooth radio range can trigger th...

PT-2026-81779

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue exists in the Bluetooth component. A remote attacker can leverage social engineering to execute arbitrary code outside the sandbox by using a crafted Chrome...

Linux Bluetooth Data Compromise

The vulnerability of the Linux operating system’s Bluetooth kernel implementation is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information...

Bluetooth HFP Profile Analyzer DoS

The vulnerability of the Bluetooth HFP Profile analyzer, a traffic analyzer for computer networks in Wireshark, relates to reading beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Bluetooth btintelHW_error() Buffer Overflow

The vulnerability of the btintelHWerror function in the drivers/bluetooth/btintel.c module of the Linux Bluetooth device driver is related to synchronization errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

Linux kernel Bluetooth L2CAP Buffer Overflow DoS

The vulnerability of the l2capecredconnreq function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to gain access to protected...

Bluetooth Protocol Analyzer DoS

The vulnerability of the Bluetooth protocol analyzer, specifically the traffic analysis module of Wireshark, relates to reading beyond the buffer in memory. Exploiting this vulnerability can allow a hacker to cause a service failure...

Linux Bluetooth btusb_work Heap Buffer Overflow DoS

The vulnerability of the btusbwork function in the drivers/bluetooth/btusb.c module of the Linux Bluetooth device driver lies in a buffer overflow in the dynamic memory. Exploiting this vulnerability could allow an attacker to cause a system failure...

Linux kernel Bluetooth L2CAP Buffer Overflow DoS

The vulnerabilities of the functions l2capdisconnectreq and l2capdisconnectrsp in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem are related to the reutilization of previously freed memory due to concurrent access to resources. Exploiting these vulnerabilities coul...

Linux kernel Bluetooth L2CAP Buffer Overflow

The vulnerability of the l2capecredconnreq function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to a numerical overflow issue. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

ROS-20260825-73-0019

The vulnerability of the hcicsdisconnect function in the net/bluetooth/hcievent.c module of the Linux kernel’s Bluetooth subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Wireshark Bluetooth AVRCP DoS

The vulnerability of the Bluetooth AVRCP protocol analyzer and the traffic analysis module of Wireshark is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow attackers to cause service failures...

CVE-2026-80186: Buffer Copy without Checking Size of Input

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response EIR packet that causes a buffer overflow when the target device performs Bluetooth discovery. This...

CVE-2026-13213

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

EUVD-2026-65003

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213

Zephyr RTOS Bluetooth Hearing Access Service (HAS) GATT server (subsys/bluetooth/audio/has.c) contains a NULL-pointer dereference in security_changed(). The connection-callback set is installed unconditionally via BT_CONN_CB_DEFINE, so the callback fires before the application calls bt_has_regist...