CVE-2023-21739

CVE-2023-21739 Windows Bluetooth Driver Elevation of Privilege Vulnerability. authentication| complexity| vector ---|---|--- not available| not available| not available confidentiality| integrity| availability ---|---|--- not available| not available| not available CVSS Score: not available...

Linux Distros Unpatched Vulnerability : CVE-2026-98730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53256)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcommconnectind rfcommgetsockbychannel scans rfcommsklist under the list lock, but returns the selected listener after dropping that lock without taking a reference. rfcommconnectind th...

Linux Distros Unpatched Vulnerability : CVE-2026-98731

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a...

Linux Distros Unpatched Vulnerability : CVE-2026-98633

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btnxpuart: Fix skb leak in nxpprocessfwdump When CONFIGDEVCOREDUMP=n, hcidevcdappend returns -EOPNOTSUPP without freeing its skb argument. This leaks...

Linux Distros Unpatched Vulnerability : CVE-2026-98632

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53253)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU. bneprxframe reads the packet type byte immediately and, for control packets, reads the control opcode and setup UUID-size byte before...

Siemens SIMATIC S7-1500 TM MFP Use After Free (CVE-2024-58013)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmtremoveadvmonitorsync This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53208)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/bluetooth/l2capcore.c:l2capsigchannel accepts BR/EDR signaling packets up to the channel MTU and dispatches each command without enforcing the signaling MTU MTUsig...

Linux Distros Unpatched Vulnerability : CVE-2026-98602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out- of-bounds reads in Bluetooth BNEP frame processing: 1. ...

Oracle Linux 10 : kernel (ELSA-2026-76738)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76738 advisory. - netfilter: nfnetlinklog: wait for rcu grace period before freeing pernet state CKI Backport Bot RHEL-271653 CVE-2026-93288 - tcp: fix stale per-CPU...

PT-2026-118828

Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-52918)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize acceptq access btsockpoll walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since th...

PT-2026-118757

Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-119007

Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935 kernel: USB: serial: mxuport: fix memory...

PT-2026-118702

Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

system_bt_AOSP10_r33_CVE-2021-0589

Fluoride Bluetooth stack Building and running on AOSP Just build AOSP - Fluoride is there by default. Building and running on Linux Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0 Download source mkdir /fluoride cd /fluoride git clone...

CVE-2026-77684

The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfphf.c does not release the AT command buffers that are still queued on hf-txpending when the RFCOMM DLC goes down. hfphfdisconnected only cancelled the work items and cleared hf-acl, and no other code path ever...

writeup-cve-2019-19194

Writeup CVE-2019-19194 This is a writeup and theoretical Proof-of-Concept of CVE-2019-19194. ⚠️ This CVE was found by https://asset-group.github.io/disclosures/sweyntooth/ Table of Content Summary Vulnerable software and version Overview Protocol Stack and Architecture Pairing Procedure Proof of...