kernel: bluetooth/l2cap: sync sock recv cb and release

In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hcirxwork, where the former releases the sock and the latter accesses it without lock protection. CPU0 CPU1 ---- ----...

kernel: Bluetooth: hci_conn: Use disable_delayed_work_sync

A flaw was found in the Bluetooth subsystem of the Linux kernel, in the handling of delayed work within the hciconn Host Controller Interface connection structure. The kernel used canceldelayedworksync when shutting down a connection, which cancels ongoing work but allows rescheduling. This could...

kernel: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2capsockcreate btsockalloc allocates the sk object and attaches it to the provided sock object. On error l2capsockalloc frees the sk object, but the dangling pointer...

kernel: Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix using rcureadunlock while iterating The usage of rcureadunlock while inside listforeachentryrcu is not safe since for the most part entries fetched this way shall be treated as rcudereference: Note that t...

kernel: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect MediaTek claim an special usb intr interface for ISO data transmission. The interface need to be released before unregistering hci device when usb disconnect...

SUSE CVE-2023-53145

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdioremove due to race condition In btsdioprobe, the data-work is bound with btsdiowork. It will be started in btsdiosendframe. If the btsdioremove runs with a unfinished work, there...

Linux kernel use-after-release vulnerability (CNVD-2025-10177)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a post-release reuse vulnerability that stems from Bluetooth L2CAP post-release reuse, which could lead to arbitrary code execution. No detailed...

PT-2025-33550

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6 Description: The Linux kernel contains an issue where bluetooth suspend/resume operations with Nintendo controllers could cause kernel stalls or panics. This was reported on Android devices using kernel 6.6...

CVE-2025-3496

An unauthenticated remote attacker can cause a buffer overflow which could lead to unexpected behaviour or DoS via Bluetooth or RS-232 interface...

CVE-2025-3496 AUMA Riester: Buffer overflow in service telegram

An unauthenticated remote attacker can cause a buffer overflow which could lead to unexpected behaviour or DoS via Bluetooth or RS-232 interface...

CVE-2025-3496 AUMA Riester: Buffer overflow in service telegram

An unauthenticated remote attacker can cause a buffer overflow which could lead to unexpected behaviour or DoS via Bluetooth or RS-232 interface...

CVE-2025-3496

CVE-2025-3496 describes an unauthenticated remote buffer overflow affecting AUMA devices (AC1.2, MEC, PROFOX, SGx/SVx, TIGRON, TIGRON SIL) that can trigger unexpected behavior or DoS via Bluetooth or RS-232. Root cause is a buffer copy without proper size checking (classic buffer overflow). Publi...

CVE-2025-3496: Buffer Copy without Checking Size of Input

An unauthenticated remote attacker can cause a buffer overflow which could lead to unexpected behaviour or DoS via Bluetooth or RS-232 interface...

About the security content of iOS 18.5 and iPadOS 18.5

About the security content of iOS 18.5 and iPadOS 18.5 This document describes the security content of iOS 18.5 and iPadOS 18.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

About the security content of watchOS 11.5

About the security content of watchOS 11.5 This document describes the security content of watchOS 11.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are availabl...

AUMA AC 安全漏洞

AUMA AC is a compact multi-turn electric actuator control system from AUMA for industrial valve automation. AUMA AC has a security vulnerability that originates from an unauthenticated, remote attacker who can trigger a buffer overflow via the Bluetooth or RS-232 interface, which could result in...

CVE-2023-53145

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdioremove due to race condition In btsdioprobe, the data-work is bound with btsdiowork. It will be started in btsdiosendframe. If the btsdioremove runs with a unfinished work, there...

DEBIAN-CVE-2023-53145

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdioremove due to race condition In btsdioprobe, the data-work is bound with btsdiowork. It will be started in btsdiosendframe. If the btsdioremove runs with a unfinished work, there...

UBUNTU-CVE-2023-53145

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdioremove due to race condition In btsdioprobe, the data-work is bound with btsdiowork. It will be started in btsdiosendframe. If the btsdioremove runs with a unfinished work, there...

CVE-2023-53145 Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdioremove due to race condition In btsdioprobe, the data-work is bound with btsdiowork. It will be started in btsdiosendframe. If the btsdioremove runs with a unfinished work, there...