19296 matches found
PT-2026-72738
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Fix UAF in hci unregister dev hci unregister dev does not disable cmd timer and ncmd timer before the hci dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed...
Linux Distros Unpatched Vulnerability : CVE-2026-74540
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: fix UAF in l2capleconnectrsp l2capleconnectrsp obtains a channel via l2capgetchanbyident but neither holds a reference nor uses...
Linux Distros Unpatched Vulnerability : CVE-2026-74539
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release. CVE-2026-74539 Note...
Linux Distros Unpatched Vulnerability : CVE-2026-74507
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: HIDP: validate numbered report payloads When hidpgetrawreport waits for a numbered report, hidpprocessdata compares the expected report number with...
Linux Distros Unpatched Vulnerability : CVE-2026-74302
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fire...
Linux Distros Unpatched Vulnerability : CVE-2026-74528
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...
CVE-2026-18164
An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...
EUVD-2026-58274
An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...
CVE-2026-18164
The CVE concerns Flow Neuroscience FL-100 with an undocumented hard-coded credential that bypasses authentication. The credential is shared across all device units, allowing an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state. Affected component is ...
CVE-2026-18164 Flow Neuroscience FL-100 Use of Hard-coded Credentials
An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...
SUSE-SU-2026:3616-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2022-4994: KVM: x86: wean fast IN from emulatorpioin bsc1273097. - CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1255616. - CVE-2026-46052: ceph: on...
CVE-2026-12236 Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length
The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...
EUVD-2026-58131
The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...
CVE-2026-12236
The CVE concerns the Zephyr Bluetooth host GATT client, where parse_read_std_char_desc() can loop indefinitely if an attacker causes a peer to reply with rsp->len = 0 during BT_GATT_DISCOVER_STD_CHAR_DESC. The loop uses rsp->len to advance the pointer and decrement remaining length, but rsp...
CVE-2026-65936
A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below...
CVE-2026-65935
Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below...
CVE-2026-65933
A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below...
CVE-2026-65932
The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. See vulnerability B-E2 in the related paper below...