CVE-2023-0396 Buffer Overreads in Bluetooth HCI

A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses...

CVE-2023-0396

CVE-2023-0396 describes a buffer overread in the Bluetooth controller’s handling of HCI command responses. The root cause is a malformed/defective Bluetooth controller causing overreads across many functions that process HCI responses. Documents consistently reference high impact on confidentiali...

PT-2025-26092

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel's Bluetooth functionality has been identified. When the HCI work queue is drained, only queue chained work is allowed, but another delayed work can...

Command injection

Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command...

CVE-2018-19860

Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command...

CVE-2018-19860

CVE-2018-19860 affects Broadcom Bluetooth firmware (Nexus 5 BCM4335C0; Raspberry Pi 3 BCM43438A1; other Broadcom-based devices) prior to summer 2014. The issue is an improper restriction of LMP commands, allowing an LMP command to cause execution of memory contents, effectively enabling memory co...

CVE-2018-19860: Incorrect Permission Assignment for Critical Resource

Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command...

CVE-2016-10391

In all Qualcomm products with Android releases from CAF using the Linux kernel, the length in an HCI command is not properly checked for validity...

CVE-2016-10391

In all Qualcomm products with Android releases from CAF using the Linux kernel, the length in an HCI command is not properly checked for validity...

CVE-2016-10391: Improper Input Validation

In all Qualcomm products with Android releases from CAF using the Linux kernel, the length in an HCI command is not properly checked for validity...