23754 matches found
CVE-2026-19939 Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption
The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...
CVE-2026-19939 Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption
The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...
CVE-2026-19939
The Bluetooth Classic AVDTP signalling layer in the Zephyr RTOS (with CONFIG_BT_A2DP enabled) contains a vulnerability where a stale timeout work item can cause kernel timeout-list corruption . When a remote BR/EDR peer disconnects an AVDTP signalling channel without responding to a request, the ...
CVE-2026-19939
The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...
CVE-2026-81507
ESF-IDF is the Espressif Internet of Things IOT Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2cmain.c and l2cutils.c does not consistently validate option lengths against the remaining received packet bytes. A...
USN-8924-1 linux vulnerabilities
It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real PID value while inside a PID namespace. A local attacker could use this to expose sensitive information. CVE-2017-5967 Wen Xu discovered that the XFS file system implementation in the Linux...
USN-8924-1: Linux kernel vulnerabilities
It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real PID value while inside a PID namespace. A local attacker could use this to expose sensitive information. CVE-2017-5967 Wen Xu discovered that the XFS file system implementation in the Linux...
CVE-2026-81507 ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
ESF-IDF is the Espressif Internet of Things IOT Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2cmain.c and l2cutils.c does not consistently validate option lengths against the remaining received packet bytes. A...
CVE-2026-81507
The ESF-IDF (Espressif IoT Development Framework) contains an out-of-bounds read vulnerability in the BlueDroid L2CAP configuration-option processing within l2c_main.c and l2c_utils.c. Due to inconsistent validation of option lengths against received packet bytes, a remote unauthenticated BR/EDR ...
CVE-2026-81507
ESF-IDF is the Espressif Internet of Things IOT Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2cmain.c and l2cutils.c does not consistently validate option lengths against the remaining received packet bytes. A...
CVE-2026-90256
A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A use-after-free UAF vulnerability can occur when hciconn::l2capdata is accessed without proper locking during the disconnection indication process. This can lead to a system crash or...
CVE-2026-90251
A flaw was found in the Linux kernel's Bluetooth Microsoft MSFT driver. This vulnerability arises from insufficient validation of the evtprefixlen field against the actual response length during the readsupportedfeatures operation. A malicious Bluetooth controller could exploit this by sending a...
USN-8923-1 linux, linux-aws, linux-fips, linux-kvm, linux-lts-xenial vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - SCSI subsystem; - Bluetooth subsystem; CVE-2022-49111, CVE-2022-49114...
USN-8923-1: Linux kernel vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - SCSI subsystem; - Bluetooth subsystem; CVE-2022-49111, CVE-2022-49114...
Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability
Integer underflow wrap or wraparound in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network...
Windows Bluetooth Driver Elevation of Privilege Vulnerability
Out-of-bounds read in Microsoft Bluetooth Driver allows an unauthorized attacker to elevate privileges with a physical attack...
Windows Bluetooth Port Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally...
Microsoft Bluetooth Driver Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Bluetooth Driver allows an authorized attacker to disclose information locally...
Windows Bluetooth Port Driver Remote Code Execution
Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network...
Microsoft Bluetooth Driver Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally...