CVE-2026-68391

A flaw was found in the Linux kernel's Bluetooth management component. This vulnerability involves a Use-After-Free UAF condition, a type of memory corruption where the system attempts to use memory after it has been freed. This can occur due to improper handling of hciconn pointers, potentially...

CVE-2026-68189

A flaw was found in the Bluetooth hcisync component of the Linux kernel. A race condition during the UUID list traversal, caused by improper synchronization between asynchronous command sync work and UUID list updates, can lead to a use-after-free vulnerability. This could allow a local attacker ...

CVE-2026-68390

A flaw was found in the Linux kernel's Bluetooth subsystem, specifically within the hcisync component. This vulnerability occurs because the hciconnparamslookup function does not properly hold a necessary lock hdev-lock during operations. This oversight can lead to unsafe list iterations or...

CVE-2026-68085

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. This vulnerability occurs when a Bluetooth device is reopened after a pending write operation was canceled, but an internal flag indicating a pending write is no...

CVE-2026-11894

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11893

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

CVE-2026-11894

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11894 Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11894

The CVE-2026-11894 entry concerns Realtek’s BEE Bluetooth HCI driver (bt_hci_bee_send in drivers/bluetooth/hci/hci_bee.c). The vulnerability arises from violating the bt_hci_driver_api buffer-ownership contract: on error, the host should retain and unref the transmit net_buf, but the pre-fix code...

CVE-2026-11894 Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11893

The CVE concerns Bouffalo Lab on‑chip BLE controllers (BL60x/BL70x/BL61x) with Zephyr’s Bluetooth HCI, where bt_bflb_send() in hci_bflb.c violates the bt_hci_driver_api.send() buffer-ownership contract. On error, the driver unrefs the buffer, but the host TX path (send_buf() in subsys/bluetooth/h...

CVE-2026-11893

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

EUVD-2026-55935

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

CVE-2026-11893 Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

CVE-2026-11893 Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

PT-2026-70060

Name of the Vulnerable Software and Affected Versions Realtek BEE Bluetooth HCI driver affected versions not specified Description The bt hci bee send function in drivers/bluetooth/hci/hci bee.c violates the buffer-ownership contract of the bt hci driver api. The driver incorrectly releases the...

Linux Distros Unpatched Vulnerability : CVE-2026-68394

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central...

PT-2026-70058

Name of the Vulnerable Software and Affected Versions Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x affected versions not specified Description The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers contains an issue where the bt bflb send function in drivers/bluetooth/hci/hci...

Linux Distros Unpatched Vulnerability : CVE-2026-68392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take...

PT-2026-70900

The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy BLE interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when ...