PT-2026-118828

Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935 kernel: USB: serial: mxuport: fix memory...

system_bt_AOSP10_r33_CVE-2021-0589

Fluoride Bluetooth stack Building and running on AOSP Just build AOSP - Fluoride is there by default. Building and running on Linux Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0 Download source mkdir /fluoride cd /fluoride git clone...

CVE-2026-77684

The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfphf.c does not release the AT command buffers that are still queued on hf-txpending when the RFCOMM DLC goes down. hfphfdisconnected only cancelled the work items and cleared hf-acl, and no other code path ever...

writeup-cve-2019-19194

Writeup CVE-2019-19194 This is a writeup and theoretical Proof-of-Concept of CVE-2019-19194. ⚠️ This CVE was found by https://asset-group.github.io/disclosures/sweyntooth/ Table of Content Summary Vulnerable software and version Overview Protocol Stack and Architecture Pairing Procedure Proof of...

C-PoC-for-CVE-2024-21306

install dependencies from apt sudo apt install -y bluez-tools bluez-hcidump libbluetooth-dev git gcc python3-pip python3-setuptools python3-pydbus install pybluez from source git clone https://github.com/pybluez/pybluez.git cd pybluez sudo python3 setup.py install build bdaddr from the bluez sour...

CVE-2026-77684 Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service

The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfphf.c does not release the AT command buffers that are still queued on hf-txpending when the RFCOMM DLC goes down. hfphfdisconnected only cancelled the work items and cleared hf-acl, and no other code path ever...

CVE-2026-77684 Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service

The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfphf.c does not release the AT command buffers that are still queued on hf-txpending when the RFCOMM DLC goes down. hfphfdisconnected only cancelled the work items and cleared hf-acl, and no other code path ever...

CVE-2026-77684

The Bluetooth Classic Hands-Free Profile (HFP) HF role in Zephyr RTOS (subsys/bluetooth/host/classic/hfp_hf.c) contains a memory leak where AT command buffers are not released when the RFCOMM DLC goes down. This causes a permanent leak from the fixed hf_pool . If the pool is exhausted, subsequent...

whisperpair-poc-tool

WhisperPair-PoC-Tool and Research A deep dive into CVE-2025-36911 and the security gaps in Google's Fast Pair ecosystem Blog Post Executive Summary Google Fast Pair was designed to make Bluetooth pairing seamless: tap a notification and you're connected. But what happens when that seamless...

kernel: Bluetooth: hci_sync: Fix advertising data UAFs

A flaw was found in the Linux kernel's Bluetooth subsystem. Specifically, the hcisync component, which manages Bluetooth advertising data, is susceptible to a Use-After-Free UAF vulnerability. This occurs when a pointer to advertising data becomes invalid but is still accessed, particularly durin...

poc-for-cve-2020-0022

cve-2020-0022 poc for cve-2020-0022 usage gcc poc.c -lbluetooth -o poc poc MACADDR info This poc should be stable on android 8.1.0,once it run into truncating packet, crash. But it cloud be very unstable, on Samsung s9 plus surely unstable. Run poc on raspberry pi 3B has been tested okay. run...

CVE-2024-31320-

CVE-2024-31320- Get GeoLocation of Exploited Device using CVE-2024-31320& bluetooth...

CVE-2017-0785

CVE-2017-0785 PoC This is just a personal study based on the Android information leak vulnerability released by Armis. Further reading: https://www.facebook.com/khelfatni To run, be sure to have pybluez and pwntools installed. sudo apt-get install bluetooth libbluetooth-dev sudo pip install pyblu...

trackem

trackem Passive Device Tracker AndroidTrackEm Mobile is a real-time, passive Wi-Fi + Bluetooth LE probe-request scanner designed for OSINT, red-team ops, and wireless research.It listens for client devices phones, laptops, IoT that are actively broadcasting the names of Wi-Fi networks...

wifisting

wifisting A GTK4 wireless security toolkit for Linux. 57 modules covering Wi-Fi, Bluetooth, RF, router-side and network MITM work behind one interface. Every module is a standalone shell script. The GUI is a view over them, not a container — nothing is locked behind the interface. Early...

CVE-2026-98458

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can cause a Denial of Service DoS through a reference count leak during Bluetooth Isochronous ISO channel attachment. When a socket attempts to attach to a channel that is already connected or in use by another socket, t...

CVE-2026-98461

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability can lead to a Denial of Service DoS due to an out-of-bounds memory read. The issue occurs when the Host Controller Interface HCI socket implementation filters event packets without verifying that the packet buffer is...

CVE-2026-98457

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP implementation. An adjacent attacker within Bluetooth range could exploit this vulnerability by transmitting specially crafted, undersized network frames. Because the kernel fails to validate packe...

CVE-2026-98460

A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local, unprivileged user to bypass security restrictions and send unauthorized commands directly to the Bluetooth hardware. The vulnerability exists because the Host Controller Interface HCI raw socket improperly filte...