CVE-2026-76922 NULL Pointer Dereference in Wireshark

Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76922

Wireshark's Bluetooth BR/EDR FHS protocol dissector has a null pointer dereference causing a crash (DoS). Affected versions: 4.4.0–4.4.18 and 4.6.0–4.6.7. CVSS 5.5 (medium). No exploitation details provided. Upgrade to a patched version. See wnpa-sec-2026-80 for details.

CVE-2026-76917

A heap-based buffer overflow exists in the Bluetooth AVRCP (Audio/Video Remote Control Profile) protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 . A local user who processes a specially crafted Bluetooth AVRCP packet can trigger a crash of the Wireshark application, res...

CVE-2026-76917 Heap-based Buffer Overflow in Wireshark

Bluetooth AVRCP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76882 Out-of-bounds Read in Wireshark

Bluetooth Attribute Protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76882

Wireshark's Bluetooth Attribute Protocol (ATT) dissector crashes in versions 4.6.0–4.6.7 and 4.4.0–4.4.18 when processing malformed Bluetooth traffic, causing denial of service. CVSS 4.7 (Medium) requires local access and user interaction. No exploitation evidence is provided. Upgrade to a patche...

CVE-2026-74539

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. A missing lock in a critical function allows for concurrent access to internal data structures without proper synchronization. This concurrency issue could lead to system instability or a denial of service, impacting the availability...

CVE-2026-74541

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. This vulnerability arises from the system's failure to properly clear isodata when a connection is detached from its host controller connection hcon. A local attacker could exploit this use-after-free condition to cause a denial of...

CVE-2026-74536

A flaw was found in the Bluetooth ISO subsystem of the Linux kernel. This vulnerability occurs due to an issue in how socket references are managed after a socket is released, specifically within the isosockkill and isosockclose functions. This improper handling leads to a memory leak, which a...

CVE-2026-74535

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. This vulnerability arises from a race condition where the isosocktimeout function can execute concurrently with isoconndel, leading to a Use-After-Free UAF condition. A UAF vulnerability allows an attacker to potentially execute...

CVE-2026-74301

A flaw was found in the Linux kernel's Bluetooth driver. An error in handling Bluetooth packets can cause a memory leak, where a data structure is not properly released. This continuous leakage of memory could potentially lead to system instability or a denial of service...

PT-2026-78853

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.7 Wireshark versions 4.4.0 through 4.4.18 Description A heap-based buffer overflow in the Bluetooth AVRCP Profile protocol dissector can lead to a crash, resulting in a denial of service. Recommendations...

PT-2026-78843

Bluetooth Attribute Protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-72337

A flaw was found in the Linux kernel's Bluetooth 6LoWPAN IPv6 over Low-Power Wireless Personal Area Networks component. This vulnerability occurs due to a race condition during the module's exit process, where a scheduled task attempts to access memory that has already been released. A local...

CVE-2026-72336

A flaw was found in the Linux kernel's Bluetooth 6LoWPAN IPv6 over Low-Power Wireless Personal Area Networks component. A race condition exists where an L2CAP Logical Link Control and Adaptation Protocol connection is accessed after its protection is dropped, allowing it to be deallocated...

CVE-2026-72335

A flaw was found in the Linux kernel's Bluetooth Management MGMT component. A use-after-free vulnerability exists in the advertisement monitor add failure cleanup process. This occurs because an advertisement monitor object is prematurely freed while a subsequent management routine attempts to...

CVE-2026-72334

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream handling. A remote attacker, by sending specially crafted malformed Bluetooth ISO packets, could trigger a kernel panic, leading to a denial of service. Additionally, this vulnerability could result in a memory leak within th...

CVE-2026-72333

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol implementation. A remote attacker, by continuously streaming data to a host, can trigger an identifier ident leak. This occurs because identifiers for certain commands, such as L2CAPLECREDITS, are...

DEBIAN-CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...