Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb – revert the use of devmkzalloc in btusb This change reverts to the behavior described in commit 98921dbd00c4e “Bluetooth: Use devmkzalloc in btusb.c file”. In btusbprobe, we use devmkzalloc to allocate the btusb...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: msft: fixed a slab-use-after-free in msftdoclose By tying the lifetime of msft-data to hdev by freeing it in hcireleasedev, the following issue was addressed: Use msftdoclose msft = hdev-msftdata; if !msft ...1...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: bnep: Rejects short frames before parsing. A BNEP peer can send a short BNEP SDU. bneprxframe reads the packet type byte immediately. For control packets, it also reads the control opcode and the setup UUID-size byt...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcisock: Fixed an issue where user input was not validated. The length of user input was checked before copying data...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcildisc: Clearing HCIUARTPROTOINIT upon error When hciregisterdev fails in hciuartregisterdev, HCIUARTPROTOINIT is not cleared before calling hu-proto-closehu and setting hu-hdev to NULL. This means that incoming UART...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Fixed null-ptr-deref in l2capsockresumecb. syzbot reported null-ptr-deref in l2capsockresumecb. 0 l2capsockresumecb has a similar issue that was fixed in commit 1bff51ea59a9 “Bluetooth: fixed use-after-free errors i...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: qca: fixed an underflow of the NVM tag length in the TLV parser In the TLVTYPENVM branch of qcatlvcheckdata, the loop bound is “while idx length - sizeofstruct tlvtypenvm”. “length” is a signed int from the firmware...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmfmac – Fix for use-after-free when rescheduling the brcmfbtcoexinfo worker. The brcmfbtcoexdetach function only shuts down the btcoex timer if the timeron flag is set to false. However, the brcmfbtcoextimerfunc function...

Bluetooth-Crash-CVE-2017-0785

CVE-2017-0785 Bluetooth module crash This script is a modified version of https://github.com/ojasookert/CVE-2017-0785. It leaks information via SDP due to out-of-bound bytes, but sending too many packets or search requests causes the Bluetooth module on an Android smartphone above Android 4.0 to...

SUSE CVE-2026-98392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

fwbt

fwbt Writeup: https://www.labs.greynoise.io/grimoire/2024-08-20-bluuid-firewalla/ Proof of Concept code for interaction with Firewalla via Bluetooth Low-Energy and exploitation of CVE-2024-40892 / CVE-2024-40893 Without any configuration it will scan for Firewalla's in local proximity and leak th...

CVE-2026-98392

A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. An off-by-one boundary check error in the transmission interrupt handler allows an array index to exceed valid buffer limits. A local attacker could exploit this flaw to crash the system, resulting in a denial of service DoS, or...

JXL_Infotainment_CVE-2025-63895

JXLInfotainmentCVE-2025-63895 CVE-2025-63895 Attack Name 📂 Additional Details Afftected product Affected Components Bluetooth Classic version 5.0 Bluetooth firmware stack LMP implementation Infotainment Bluetooth service Attack Vector An attacker within Bluetooth range can exploit this issue by...

SUSE-SU-2026:4687-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2022-50645: EDAC/i10nm: fix refcount leak in pcigetdevwrapper bsc1254633. - CVE-2026-31663: xfrm: hold device only for the asynchronous decryption bsc1263133. -...

kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

A flaw was found in the Bluetooth hcisync component of the Linux kernel. When the hcidevclosesync function is called during a device reset, the system may experience queuing timeouts. This occurs because the HCICMDDRAINWORKQUEUE flag is not properly set, which can lead to system instability or a...

MiracleLinux 9 : kernel-5.14.0-687.47.1.el9_8 (AXSA:2026-2048:99)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2048:99 advisory. kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset CVE-2025-68745 kernel: drm/xe:...

CVE-2026-98392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

EUVD-2026-101041

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

CVE-2026-98392 Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerabilities (USN-8923-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8923-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update...