PT-2026-64630

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the btmtksdio txrx work function contains an incorrect implementation of the time is before jiffies check. This logic error causes the lo...

PT-2026-64625

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the Bluetooth ISO implementation. The function iso conn big sync drops the socket lock to call hci get route and subsequently re-acquires it. However...

PT-2026-64626

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference exists in the Bluetooth component. The hci abort conn function reads hci skb eventhdev-sent cmd during a pending connection; however, hdev-sent cmd can be NULL...

Linux Distros Unpatched Vulnerability : CVE-2026-16473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap...

Linux Distros Unpatched Vulnerability : CVE-2026-64471

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid...

Linux Distros Unpatched Vulnerability : CVE-2026-64407

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of- bounds firmware read in nxprecvfwreqv3 During the v3...

PT-2026-64691

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth btusb component during Marvell probe failure. The problem occurs when TX URBs USB Request Blocks, which are used to transfer data between t...

Linux Distros Unpatched Vulnerability : CVE-2026-64470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe...

Linux Distros Unpatched Vulnerability : CVE-2026-64434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs...

Linux Distros Unpatched Vulnerability : CVE-2026-64405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL whi...

Linux Distros Unpatched Vulnerability : CVE-2026-64433

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete adddevicecomplete runs from...

Linux Distros Unpatched Vulnerability : CVE-2026-64404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in isoconnbigsync isoconnbigsync drops the socket...

PT-2026-64628

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the nxp recv fw req v3 function during v3 firmware downloads. The issue occurs because the function only verifies the lower bound of the offset provided i...

Linux Distros Unpatched Vulnerability : CVE-2026-64408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its...

CVE-2026-45813

Out-of-bounds Write, Integer Underflow Wrap or Wraparound vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearb...

CVE-2026-45815 Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response BLEATTOPREADMULTVARRSP may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through...

CVE-2026-45813 Apache NimBLE: Incorrect data validation in BASS add/modify source operation

Out-of-bounds Write, Integer Underflow Wrap or Wraparound vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearb...

CVE-2026-45813

Apache NimBLE versions through 1.9.0 are vulnerable to an out-of-bounds write and integer underflow (wrap or wraparound) in the BASS service. The root cause is improper validation during the parsing of Protocol Data Units (PDU) for "Add Source" and "Modify Source" operations. This flaw can result...

EUVD-2026-48586

Out-of-bounds Write, Integer Underflow Wrap or Wraparound vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearb...

CVE-2026-45813

Out-of-bounds Write, Integer Underflow Wrap or Wraparound vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearb...