EUVD-2026-103697

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

CVE-2026-98457

A vulnerability in the Linux kernel Bluetooth stack allows for an out-of-bounds read . The l2cap_data_rcv() function fails to verify the presence of two-byte or four-byte control fields before unpacking them, which can be triggered by short ERTM or streaming-mode frames. Additionally, when CRC16 ...

CVE-2026-98457

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

CVE-2026-98456 Bluetooth: mgmt: fix race in read_unconf_index_list()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98456 Bluetooth: mgmt: fix race in read_unconf_index_list()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

EUVD-2026-103696

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98456

A race condition exists in the Linux kernel Bluetooth management component within the read_unconf_index_list() function. The vulnerability occurs because hci_dev_list_lock stabilizes list membership but fails to serialize per-device flags during asynchronous controller setup. A worker can transit...

CVE-2026-98456

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98455 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

CVE-2026-98455 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

EUVD-2026-103695

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

CVE-2026-98455

The Linux kernel contains a vulnerability in the Bluetooth RFCOMM stack where a NULL pointer dereference occurs in the RFCOMM_CONNINFO getsockopt handler. When BT_DEFER_SETUP is enabled, the dlc->defer_setup flag remains set even if the session is cleared during rfcomm_recv_disc(). Consequentl...

CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

system_bt_AOSP10_r33_CVE-2020-0225

Fluoride Bluetooth stack Building and running on AOSP Just build AOSP - Fluoride is there by default. Building and running on Linux Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0 Download source mkdir /fluoride cd /fluoride git clone...

BlueBorn

BlueBorn CVE-2017-0785 Archlinux installation paru -S python-pybluez-git bluez-utils-compat pyhton3 python3-pip sudo pip install pwn TUTORIALS Discovery hcitool scan Scanning ... XX:XX:XX:XX:XX:XX Device 1 XX:XX:XX:XX:XX:XX Device 2 Use the exploit python CVE-2017-0785.py TARGET=XX:XX:XX:XX:XX V...

sploit-bX

sploit-bX Bash that installs the sploits CVE-2017-0781 and CVE-2017-0785 and everything needed for their use. These sploits are used to check if our bluetooth is vulnerable. Download the repository git clone https://github.com/CarlosDelRosario7/sploit-bX Installation Enter the folder: cd sploit-b...

btlejuice

BtleJuice Framework Introduction BtleJuice is a complete framework to perform Man-in-the-Middle attacks on Bluetooth Smart devices also known as Bluetooth Low Energy. It is composed of: an interception core an interception proxy a dedicated web interface Python and Node.js bindings How to install...

CVE-2026-98736: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Lock parent access during enhanced SCO setup Bluetooth: hciconn: Lock parent access during enhanced SCO setup hcienhancedsetupsync runs on the request workqueue without the hcidevlock held by its caller when...

CVE-2026-98737: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix inquiry cache use-after-free The sync command worker holds hdev-reqlock, but inquiry-cache updates and flushes use hdev-lock. Both hciaclcreateconnsync and hcistopdiscoverysync look up entries and read the...

PT-2026-116676

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2cap data rcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefo...