CVE-2025-7403 Bluetooth: bt_conn_tx_processor unsafe handling

Unsafe handling in btconntxprocessor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption...

CVE-2025-7403 Bluetooth: bt_conn_tx_processor unsafe handling

Unsafe handling in btconntxprocessor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption...

CVE-2025-7403

CVE-2025-7403 affects Zephyr RTOS: unsafe handling in bt_conn_tx_processor can cause a use-after-free, leading to a write-before-zero with attacker-controlled 4 bytes, enabling precise memory corruption. Impact is described as memory corruption with high availability impact; CVSS vectors indicate...

CVE-2025-7403 Bluetooth: bt_conn_tx_processor unsafe handling

Unsafe handling in btconntxprocessor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption...

CVE-2025-10457 Bluetooth: Out-Of-Context le_conn_rsp Handling

The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching...

CVE-2025-10457 Bluetooth: Out-Of-Context le_conn_rsp Handling

The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching...

CVE-2025-10457 Bluetooth: Out-Of-Context le_conn_rsp Handling

The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching...

CVE-2025-10457

Zephyr Project’s CVE-2025-10457 affects the BLE stack, specifically the le_conn_rsp handling. The vulnerable component processes BLE connection responses without confirming that a connection attempt initiated by the device actually occurred, relying solely on identifier matching. This can enable ...

PT-2025-38511

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The function responsible for handling BLE Bluetooth Low Energy connection responses does not verify whether a response is expected, relying solely on identifier matching. This means the device does n...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by Zephyr. A security vulnerability exists in Zephyr that stems from mishandling of btconntxprocessor resulting in reuse after release, which may result in memory corruption...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by Zephyr. A security vulnerability exists in Zephyr that stems from a flaw in the handling of the Bluetooth Low Energy Fixed Channel, which could lead to undefined behavior, including assertion failure, crashes, or memory...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by Zephyr. A security vulnerability exists in Zephyr that stems from a BLE connection response handler function that does not validate whether a response is expected and relies only on identifier matching...

PT-2025-38514

Name of the Vulnerable Software and Affected Versions Bluetooth Low Energy BLE affected versions not specified Description A flaw exists in the handling of Bluetooth Low Energy BLE fixed channels, such as SMP or ATT. An attacker can exploit this issue, causing the BLE target device to attempt to...

Linux Distros Unpatched Vulnerability : CVE-2022-50419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisysfs: Fix attempting to call deviceadd multiple times deviceadd shall not be called multiple times as stated in its documentation: 'Do not call...

Linux Distros Unpatched Vulnerability : CVE-2022-50386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: Fix user-after-free This uses l2capchanholdunlesszero after calling l2capgetchanblah to prevent the following trace: Bluetooth:...

Linux Distros Unpatched Vulnerability : CVE-2025-39861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early Move the creation of debugfs files into a dedicated function, and ensure they are...

PT-2025-38513

Name of the Vulnerable Software and Affected Versions Bluetooth affected versions not specified Description An unsafe handling issue in bt conn tx processor can lead to a use-after-free condition, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memo...

Linux Distros Unpatched Vulnerability : CVE-2023-53374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fail SCO/ISO via hciconnfailed if ACL gone early Not calling...

SUSE CVE-2022-50386

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2capchanholdunlesszero after calling l2capgetchanblah to prevent the following trace: Bluetooth: l2capcore.c:static void l2capchandestroystruct kref kref Bluetooth: chan...

SUSE CVE-2022-50419

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix attempting to call deviceadd multiple times deviceadd shall not be called multiple times as stated in its documentation: 'Do not call this routine or deviceregister more than once for any device structure...