19757 matches found
CVE-2025-39861 Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: vhci: Prevent use-after-free by removing debugfs files early Move the creation of debugfs files into a dedicated function, and ensure they are explicitly removed during vhcirelease, before associated data structures ar...
CVE-2025-39861 Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: vhci: Prevent use-after-free by removing debugfs files early Move the creation of debugfs files into a dedicated function, and ensure they are explicitly removed during vhcirelease, before associated data structures ar...
CVE-2025-39860 Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2capsockcleanuplisten syzbot reported the splat below without a repro. In the splat, a single thread calling btacceptdequeue freed sk and touched it after that. The root cause would be the racy...
CVE-2025-39860
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2capsockcleanuplisten syzbot reported the splat below without a repro. In the splat, a single thread calling btacceptdequeue freed sk and touched it after that. The root cause would be the racy...
CVE-2025-39860
CVE-2025-39860 – Linux kernel Bluetooth UAF in l2cap_sock_cleanup_listen() . The vulnerability arises from a race between bt_accept_dequeue() and l2cap_sock_cleanup_listen() where a socket could be freed while another path still holds a reference. The root cause is a race in the l2cap_sock_cleanu...
CVE-2025-39860 Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2capsockcleanuplisten syzbot reported the splat below without a repro. In the splat, a single thread calling btacceptdequeue freed sk and touched it after that. The root cause would be the racy...
CVE-2025-7403
Unsafe handling in btconntxprocessor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption...
CVE-2025-10457
The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching...
CVE-2025-10456
A vulnerability was identified in the handling of Bluetooth Low Energy BLE fixed channels such as SMP or ATT. Specifically, an attacker could exploit a flaw that causes the BLE target i.e., the device under attack to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth...
Integer Overflow or Wraparound
Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the handling of Bluetooth Low Energy BLE fixed channels, such as SMP or ATT. An attacker can cause the target device to send disconnection requests for fixed channels, which is not permitted by the...
Improper Handling of Length Parameter Inconsistency
Overview Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via improper validation of the leconnrsp process. An attacker can cause information disclosure, data manipulation, or denial of service by sending specially crafted Bluetooth connectio...
Improperly Implemented Security Check for Standard
Overview Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard in the leconnrsp process. An attacker can cause a denial of service by sending an out-of-context Bluetooth Low Energy connection response when no connection request was initiated...
Write-what-where Condition
Overview Affected versions of this package are vulnerable to Write-what-where Condition via the btconntxprocessor function. An attacker can achieve precise memory corruption by triggering a use-after-free condition that allows writing attacker-controlled data before memory is zeroed. Remediation...
CVE-2025-10456
CVE-2025-10456 concerns BLE fixed-channel handling (SMP/ATT) in Zephyr RTOS. The root issue: a device may be tricked into sending a disconnection request for a fixed channel, which is disallowed by the Bluetooth spec, triggering undefined behavior such as assertion failures, crashes, or memory co...
CVE-2025-10456 Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests
A vulnerability was identified in the handling of Bluetooth Low Energy BLE fixed channels such as SMP or ATT. Specifically, an attacker could exploit a flaw that causes the BLE target i.e., the device under attack to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth...
CVE-2025-10456 Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests
A vulnerability was identified in the handling of Bluetooth Low Energy BLE fixed channels such as SMP or ATT. Specifically, an attacker could exploit a flaw that causes the BLE target i.e., the device under attack to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth...
CVE-2025-10456 Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests
A vulnerability was identified in the handling of Bluetooth Low Energy BLE fixed channels such as SMP or ATT. Specifically, an attacker could exploit a flaw that causes the BLE target i.e., the device under attack to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth...
CVE-2025-10458 Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values
Parameters are not validated or sanitized, and are later used in various internal operations...
CVE-2025-10458
CVE-2025-10458 affects Zephyr Project RTOS Bluetooth; the issue is that the Bluetooth LE connection response (le_conn_rsp) does not sanitize/validate CID, MTU, and MPS values, which are used in internal operations. Public sources describe that improper handling of these parameters can enable info...