Windows Bluetooth Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network...

Windows Bluetooth Service Remote Code Execution Vulnerability

Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network...

Windows Bluetooth Port Driver Remote Code Execution

Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network...

Microsoft Bluetooth Driver Elevation of Privilege Vulnerability

Integer underflow wrap or wraparound in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2026-90093

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. This vulnerability allows for a Use-After-Free UAF condition when handling getsockopt and setsockopt operations. An attacker could exploit this by causing the system to attempt to access...

CVE-2026-90092

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol implementation. A race condition can occur when a new connection is established while a parent L2CAP channel is being torn down, due to inconsistent locking. This can lead to a Use-After-Free UAF...

CVE-2026-90091

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A race condition, a situation where multiple operations occur at the same time and interfere with each other, exists between internal functions. This can lead to a null pointer...

CVE-2026-90090

A flaw was found in the Linux kernel's Bluetooth MTK SDIO Secure Digital Input Output driver. The btmtksdiotxpacket function, which handles data transmission, incorrectly calculates the transfer size. This leads to an out-of-bounds read of uninitialized memory, which is then sent to the Bluetooth...

CVE-2026-90089

A flaw was found in the Bluetooth btnxpuart driver in the Linux kernel. This vulnerability occurs because the nxpprocessfwdump function does not properly validate the length of the firmware dump header. A remote attacker could send a specially crafted, truncated Bluetooth frame, leading to an...

CVE-2026-90088

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication component. A remote attacker can exploit this by sending a specially crafted Parameter Negotiation PN frame with a zero Maximum Transmission Unit MTU value. This can lead to an infinite loop during data...

SUSE-SU-2026:4639-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes bsc1273290. - CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdevput i...

CVE-2026-19936

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

CVE-2026-19937

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayablemsg.c manages a static pool of CONFIGBTMESHACCESSDELAYABLEMSGCOUNT message contexts default 4 threaded onto a freectx or busyctx list. releasedelayablemsgctx returned a context to freectx only when...

CVE-2026-19938

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19936: Concurrent Execution using Shared Resource with Improper Synchronization

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

Microsoft Windows: CVE-2026-83739: Windows Bluetooth Service Remote Code Execution Vulnerability

Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network...

Microsoft Windows: CVE-2026-70126: Windows Bluetooth Port Driver Remote Code Execution

Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network...

CVE-2026-87713: Use After Free

Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network...

CVE-2026-19938: Use After Free

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

Microsoft Windows: CVE-2026-83777: Windows Bluetooth Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network...