PT-2026-112604

Name of the Vulnerable Software and Affected Versions Windows Bluetooth A2DP driver affected versions not specified Description An integer underflow wrap or wraparound occurs in the Bluetooth A2DP driver. This allows an authorized attacker to elevate privileges over an adjacent network, potential...

Microsoft Windows: CVE-2026-83776: Windows Bluetooth Driver Elevation of Privilege Vulnerability

Out-of-bounds read in Microsoft Bluetooth Driver allows an unauthorized attacker to elevate privileges with a physical attack...

Microsoft Windows: CVE-2026-96844: Microsoft Bluetooth Driver Elevation of Privilege Vulnerability

Integer underflow wrap or wraparound in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network...

PT-2026-113092

Name of the Vulnerable Software and Affected Versions Microsoft Bluetooth Driver affected versions not specified Description An integer underflow wrap or wraparound occurs in the driver, which allows an authorized attacker to elevate privileges over an adjacent network. Integer underflow is a...

CVE-2026-87713: Use After Free

Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network...

Microsoft Windows: CVE-2026-87713: Windows Bluetooth Port Driver Remote Code Execution

Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network...

PT-2026-112896

Name of the Vulnerable Software and Affected Versions Windows Bluetooth Port Driver affected versions not specified Description A use-after-free condition in the Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network. Use-after-free is a memor...

CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19938

The Bluetooth host stack is vulnerable to a use-after-free and memory corruption in the ATT transmit path. Specifically, in subsys/bluetooth/host/att.c, the BT_ATT_OP_SIGNED_WRITE_CMD branch incorrectly calls net_buf_unref(buf) when bt_smp_sign() fails. This violates the established contract wher...

EUVD-2026-98095

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19937 Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayablemsg.c manages a static pool of CONFIGBTMESHACCESSDELAYABLEMSGCOUNT message contexts default 4 threaded onto a freectx or busyctx list. releasedelayablemsgctx returned a context to freectx only when...

CVE-2026-19937 Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayablemsg.c manages a static pool of CONFIGBTMESHACCESSDELAYABLEMSGCOUNT message contexts default 4 threaded onto a freectx or busyctx list. releasedelayablemsgctx returned a context to freectx only when...

CVE-2026-19937

The Bluetooth Mesh Access layer in Zephyr RTOS (specifically subsys/bluetooth/mesh/delayable_msg.c) contains a resource leak vulnerability. The bt_mesh_delayable_msg_manage() function fails to correctly re-insert a message context into the pool during a chunk-exhaustion error path, causing the co...

EUVD-2026-98093

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

CVE-2026-19936 Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

CVE-2026-19936 Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

CVE-2026-19936

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c is vulnerable to a NULL pointer dereference due to unsynchronized access to shared intrusive lists (busy_ctx, free_ctx, free_chunks). Specifically, bt_mesh_delayable_msg_manage() (running on the Bluet...

SUSE-SU-2026:24181-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-26730: hwmon: nct6775 Fix access to temperature configuration registers bsc1222538. - CVE-2025-38704: rcu/nocb: Fix possible invalid...

OPENSUSE-SU-2026:22091-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function bsc1253340. - CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock...