PT-2026-110226

The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll sw/ull llcp conn upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the host notification llcp rx node retain, which mark...

CVE-2026-19740: Missing Release of Memory after Effective Lifetime

The Link Layer Control Procedure LLCP implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LLPHYUPDATEIND so that it can later be reused for the host notification when the update instant is reached llcprxnoderetain in...

PT-2026-110227

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.4.0 through 3.7.x Description The Link Layer Control Procedure LLCP implementation of the Bluetooth LE Controller fails to release a retained receive node when processing invalid Protocol Data Units PDUs during PHY Update,...

CVE-2026-19738: Missing Release of Memory after Effective Lifetime

The Bluetooth Link Layer Control Procedure LLCP implementation for Connected Isochronous Stream CIS creation retains an RX node ctx-noderef.rx, marked NODERXTYPERETAIN so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LLCISREQ, and on the...

CVE-2026-106314

An incorrect authorization flaw was found in the Bluetooth component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501533684...

CVE-2026-8374

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol...

EUVD-2026-95745

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol...

CVE-2026-8374 Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol...

CVE-2026-8374

The SwitchBot Door Lock Series is affected by a vulnerability involving the misuse and misconfiguration of cryptographic algorithms during Bluetooth communication. An attacker can exploit a manipulated communication protocol to bypass the electronic lock and gain access to security controls. The ...

USN-8905-2 linux-gcp vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - x86 architecture; - Intel NPU Driver; - Auxiliary...

CVE-2026-19570

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bapbroadcastsink.c copies subgroup metadata from a received Basic Audio Announcement BASE into the static Broadcast Audio Scan Service parameter structure modsrcparam without any bounds check. In basesubgroupmetacb the destination element was...

EUVD-2026-95526

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bapbroadcastsink.c copies subgroup metadata from a received Basic Audio Announcement BASE into the static Broadcast Audio Scan Service parameter structure modsrcparam without any bounds check. In basesubgroupmetacb the destination element was...

CVE-2026-19570 Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bapbroadcastsink.c copies subgroup metadata from a received Basic Audio Announcement BASE into the static Broadcast Audio Scan Service parameter structure modsrcparam without any bounds check. In basesubgroupmetacb the destination element was...

CVE-2026-19570 Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bapbroadcastsink.c copies subgroup metadata from a received Basic Audio Announcement BASE into the static Broadcast Audio Scan Service parameter structure modsrcparam without any bounds check. In basesubgroupmetacb the destination element was...

CVE-2026-19570

The LE Audio Broadcast Sink in the Bluetooth subsystem is vulnerable to an out-of-bounds write because it copies subgroup metadata from a received Basic Audio Announcement (BASE) into the mod_src_param structure without proper bounds checking. Specifically, the base_subgroup_meta_cb() function fa...

hi_my_name_is_keyboard

Ciao, mi chiamo Keyboard Questo repository contiene script proof-of-concept per CVE-2023-45866, CVE-2024-21306 e CVE-2024-0230. Ulteriori dettagli sono disponibili nel post del blog. Proof of Concept| Descrizione ---|--- Iniezione di tasti su Android| Associa forzatamente una tastiera Bluetooth...

bleah

Este repositorio está OBSOLETO, por favor usabettercap ya que esta herramienta ha sido migrada a sus módulos BLE...

CVE-2026-19570: Buffer Copy without Checking Size of Input

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bapbroadcastsink.c copies subgroup metadata from a received Basic Audio Announcement BASE into the static Broadcast Audio Scan Service parameter structure modsrcparam without any bounds check. In basesubgroupmetacb the destination element was...

CVE-2026-8374: Generation of Weak Initialization Vector (IV)

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol...

ROS-20261009-73-0062

The vulnerability of the downloadfirmware function in the drivers/bluetooth/hcill.c file of the Bluetooth device driver for the Linux operating system is related to incomplete filtering of special elements. Exploiting this vulnerability could allow an attacker to cause a service failure...