19728 matches found
CVE-2025-39983
CVE-2025-39983 is a Linux kernel Bluetooth issue: UAF in hci_conn_tx_dequeue due to improper locking of hdev while processing HCI_EV_NUM_COMP_PKTS, leading to a KASAN slab-use-after-free in hci_conn.c and related Bluetooth code paths (hci_num_comp_pkts_evt, hci_event.c, hci_core.c). Affects the B...
CVE-2025-39983 Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciconntxdequeue This fixes the following UAF caused by not properly locking hdev when processing HCIEVNUMCOMPPKTS: BUG: KASAN: slab-use-after-free in hciconntxdequeue+0x1be/0x220...
CVE-2025-39982
CVE-2025-39982: Linux kernel Bluetooth subsystem use-after-free in hci_acl_create_conn_sync (and related paths like hci_le_create_conn_sync) has been fixed. The issue occurred when a connection in BT_OPEN state pending command submission could be freed, leading to a use-after-free on the connecti...
CVE-2025-39983 Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciconntxdequeue This fixes the following UAF caused by not properly locking hdev when processing HCIEVNUMCOMPPKTS: BUG: KASAN: slab-use-after-free in hciconntxdequeue+0x1be/0x220...
CVE-2025-39982 Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciaclcreateconnsync This fixes the following UFA in hciaclcreateconnsync where a connection still pending is command submission conn-state == BTOPEN maybe freed, also since this also can happen wi...
CVE-2025-39982 Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciaclcreateconnsync This fixes the following UFA in hciaclcreateconnsync where a connection still pending is command submission conn-state == BTOPEN maybe freed, also since this also can happen wi...
CVE-2025-39981
CVE-2025-39981 affects the Linux kernel Bluetooth MGMT path. A use-after-free (UAF) can occur for struct mgmt_pending when it is freed while still processed, addressed by introducing mgmt_pending_valid and stricter locking (mgmt_pending_lock) to avoid TOCTOU and ensure removal from the pending li...
CVE-2025-39981 Bluetooth: MGMT: Fix possible UAFs
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible UAFs This attemps to fix possible UAFs caused by struct mgmtpending being freed while still being processed like in the following trace, in order to fix mgmtpendingvalid is introduce and use to check...
CVE-2025-39981 Bluetooth: MGMT: Fix possible UAFs
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible UAFs This attemps to fix possible UAFs caused by struct mgmtpending being freed while still being processed like in the following trace, in order to fix mgmtpendingvalid is introduce and use to check...
CVE-2025-39981
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible UAFs This attemps to fix possible UAFs caused by struct mgmtpending being freed while still being processed like in the following trace, in order to fix mgmtpendingvalid is introduce and use to check...
Oracle Linux 8 : kernel (ELSA-2025-17797)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-17797 advisory. - Bluetooth: L2CAP: Fix use-after-free CKI Backport Bot RHEL-116277 CVE-2023-53305 Tenable has extracted the preceding description block directly from...
PT-2025-42258
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.16-rc7 Description The Linux kernel contains a use-after-free flaw within the Bluetooth stack, specifically in the hci conn tx dequeue function. This issue arises from improper locking of the hdev structure whe...
Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel (Azure) vulnerabilities (USN-7819-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7819-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from not properly locking hdev to handle HCIEVNUMCOMPPKTS events, which could lead to reuse after release...
PT-2025-42256
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to Bluetooth MGMT handling, potentially leading to use-after-free UAF conditions. This issue arises from the improper management of mgmt pending...
PT-2025-42257
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.16.0-rc7 Description The Linux kernel contains a use-after-free issue within the Bluetooth stack, specifically in the hci acl create conn sync function. This flaw occurs when a connection is pending command...
EUVD-2025-34362
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...
EUVD-2025-34267
Double free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...
