CVE-2026-98819: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98632: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

CVE-2026-98809: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...

Linux Distros Unpatched Vulnerability : CVE-2026-98738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: Serialize SMP remote OOB data access buildpairingcmd looks up remote OOB data and copies its contents without holding hdev-lock, which serializes the...

PT-2026-116675

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read unconf index list read unconf index list counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hci dev list lock stabilizes list...

PT-2026-116955

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: Lock parent access during enhanced SCO setup Bluetooth: hci conn: Lock parent access during enhanced SCO setup hci enhanced setup sync runs on the request workqueue without the hci dev lock held by its caller...

PT-2026-116951

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintel hw error The "Exception info %s" print uses skb-data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end. Bound the print with "%.s"...

PT-2026-116851

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending mesh send sync entries on cancel In send cancel, pending mesh tx objects are removed from the hdev-mesh pending list and freed via mesh send complete. However, if a mesh transmission was already...

Linux Distros Unpatched Vulnerability : CVE-2026-98733

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcicore: Serialize fragmented ISO packet queueing The fragmented path in hciqueueiso calls skbqueuetail without holding conn-dataq.lock. The socket...

CVE-2026-98736: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Lock parent access during enhanced SCO setup Bluetooth: hciconn: Lock parent access during enhanced SCO setup hcienhancedsetupsync runs on the request workqueue without the hcidevlock held by its caller when...

PT-2026-116676

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2cap data rcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefo...

CVE-2026-78306

CVE-2026-78306 — DJI Drone DUML Command Injection over Bluetooth POC CVE record: https://vulners.com/cve/CVE-2026-78306 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78306 Description DJI drones expose a Bluetooth interface used to establish a connection to the drone's Wi-Fi interface and exchan...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.3 contains security vulnerabilities. These vulnerabilities stem from improper serialization of SCO and ISO scheduling and disconnection processes in the Bluetooth hcicore. In the case of hcilowsent, the connection may be released after releasing the RCU read lock,...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.12 has security vulnerabilities. These vulnerabilities stem from insufficient validation of short RX/TX frames and control flows during the processing of Bluetooth BNEP frames. No checks are performed before reading the BNEP header, control type bytes, filter count, a...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.19 has a security vulnerability. This vulnerability stems from improper locking and serialization in Bluetooth SMP remote OOB data access. The buildpairingcmd function searches for and copies remote OOB data without holding the hdev-lock. This may lead to post-release...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.1 contains security vulnerabilities. These vulnerabilities arise from the Bluetooth mgmt mechanism, which fails to remove queued meshsendsync entries when transmission is canceled. As a result, the meshtx pointer, which has been released, may be reused in subsequent...

BLE-TPMS

CVE-2024-39081 Link: https://vulners.com/cve/CVE-2024-39081 BLE BASED TREEL TPMS for bikes Here, we performed and explained TPMS data manipulation over bluetooth. we can send false alarm to App user over bluetooth. Detailed vulnerability findings and analysis are stored in the repository. File Na...

SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4706-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4706-1 advisory. The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security...

packages_apps_Bluetooth_AOSP10_r33_CVE-2020-0183

This repository does not have a README...

CVE-2026-77812

CVE-2026-77812 — DJI Drone Cleartext BLE Transmission of Wi-Fi PSK and Session UUID POC CVE record: https://vulners.com/cve/CVE-2026-77812 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77812 Description DJI Drone expose a DUML control channel over Bluetooth. Every message on that channel — in bo...