PT-2026-61445

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where the system fails to properly handle ISO END frames received without a preceding ISO START frame. In the iso recv function, the I...

CVE-2026-63944: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: fix UAF in hcilecreatecissync hcilecreatecissync dereferences conn-conntimeout after releasing both rcureadlock and hcidevlockhdev. The conn pointer was obtained from an RCU-protected iteration over...

CVE-2026-63870: Improper Restriction of Operations within the Bounds of a Memory Buffer

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpanxmit The aoe driver or similar generates a non-IPv6 packet e.g., ETHPAOE and queues it for transmission via devqueuexmit on a 6LoWPAN interface configured by the user or test...

PT-2026-61262

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Bluetooth ISO implementation where iso sock close calls iso sock clear timer before acquiring the socket lock. This allows iso sock clear timer to read the...

CVE-2026-63945: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-64126: Out-of-bounds Read

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

CVE-2026-64144: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix urb-setuppacket leak in error paths The setuppacket of control urb is not freed if usbsubmiturb fails or the submitted urb is killed. Add free in these two paths...

CVE-2026-64127: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecredreconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 "Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings" converted the on-stack request PDU in l2capecredreconfigure from an...

CVE-2026-63871: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on isopi fields in hcigetroute calls isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync call hcigetroute using isopisk-dst, isopisk-src, and isopisk-srctype without holding locksock. Thes...

CVE-2026-63945: Concurrent Execution using Shared Resource with Improper Synchronization

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-63975: Use After Free

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2capecredconnrsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2capchandel may invalidate the tmp cursor...

SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:3089-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3089-1 advisory. The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues The following security issues were fixed: -...

BLE GATT Attack Surface

Analyzes GATT services and characteristics for risky read/write/notify exposure !/usr/bin/env python3 -- coding: utf-8 -- """BLE analyze — rank the GATT attack surface exposed by a BLE session.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin from datetime...

BLE GATT Fuzz

Fuzzes writable GATT characteristics with mutated payloads to probe firmware input handling disconnects, errors, anomalous notifies !/usr/bin/env python3 -- coding: utf-8 -- """ BLE GATT Fuzzer — mutates writes against writable characteristics on a live BLE session. """ from future import...

BleedingTooth Check

Assesses local Linux Bluetooth/kernel exposure to the BleedingTooth family CVE-2020-12351 BadKarma, CVE-2020-12352 BadChoice, CVE-2020-24490 BadVibes. Detection only — no exploit payload. !/usr/bin/env python3 -- coding: utf-8 -- """ BleedingTooth exposure check — local Linux kernel Bluetooth sta...

BLE GATT Services

Enumerates GATT services exposed by a connected BLE peripheral !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — list GATT services on a connected peripheral.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin import json class ModulePost,...

BLE GATT Client

Connects to a Bluetooth Low Energy peripheral over GATT and creates a session for service enumeration, read/write, and notify capture !/usr/bin/env python3 -- coding: utf-8 -- """BLE GATT bind listener — connects to a peripheral and opens a GATT session.""" from kittysploit import from...

BLE GATT Characteristics

Enumerates GATT characteristics UUID, handle, properties for a BLE session !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — list GATT characteristics and properties.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin import json class ModulePost,...

BLE Read Characteristic

Reads a GATT characteristic value from a connected BLE peripheral !/usr/bin/env python3 -- coding: utf-8 -- """BLE manage — read a GATT characteristic value.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin from lib.protocols.ble.bleclient import...

BLE Write Characteristic

Writes a value to a GATT characteristic on a connected BLE peripheral !/usr/bin/env python3 -- coding: utf-8 -- """BLE manage — write a GATT characteristic value.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin from lib.protocols.ble.bleclient import...