Bestechic BES2300 Bluetooth Audio SoC Heap Buffer Overflow DoS

The vulnerability of the avrcpindicateprocessdataind function in the microprogramming-based audio chipset of Bestechnic BES2300 Bluetooth Audio SoC is related to buffer overflow attacks. Exploiting this vulnerability could allow an attacker to cause a service failure by sending a specially crafte...

Bestechic BES2300 Bluetooth Audio SoC Buffer Overflow DoS

The vulnerability of the btmaclhandle function in Bestechnic BES2300 Bluetooth Audio SoC microprogramming software is related to a numerical overflow issue. Exploiting this vulnerability could allow an attacker to cause a service failure by sending a specially crafted L2CAP packet...

Bestechnic BES2300 Bluetooth Audio SoC Buffer Overflow DoS

The vulnerability of the l2caphandledata function in the microprogramming-based audio chipset of Bestechnic BES2300 Bluetooth Audio SoC is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially...

BadBlue

BadBlue Windows CVE-2024-21306 BadBlue implementation Using DuckyScript Unauthenticated Peering Leading to Code Execution Using HID Keyboard This is an implementation of the CVE discovered by marcnewlin And some code from BlueDucky Introduction BadBlue is a powerful tool for exploiting a...

CVE-2025-36911_scan

CVE-2025-36911 scanner Tests unauthenticated BR/EDR L2CAP connections to audio PSMs A2DP/AVRCP and detects Fast Pair service GFPS on BLE. Requirements Linux BlueZ installed and bluetooth service active for BLE functionality. Bluetooth adapter enabled bluetoothctl power on. Debian based OS sudo ap...

Linux-Heap-Based-Type-Confusion-in-L2CAP

Linux: Heap-Based Type Confusion in L2CAP CVE-2020-12351 Linux: Heap-Based Type Confusion in L2CAP PoC CVE-2020-12351 on BLE implementation Why did I modify the original PoC? The original PoC is focused on sending a malicious l2cap packet via Bluetooth Classic. However, I had a requirement to tes...

Raven-Storm

Raven-Storm Toolkit Raven-Storm is a powerful DDoS toolkit for penetration tests, including attacks for several protocols written in python3.8. Takedown WiFi access points, devices in your network, servers, services, and Bluetooth devices with ease. Ravenabbreviation is desinged to help you to...

BLESuite

BLESuite README Overview BLESuite is a python package to make Bluetooth Low Energy BLE device communication more user friendly and enables rapid BLE device testing. Version 2 of BLESuite removes the dependency on PyGattlib and BlueZ and instead uses a modified version of PyBT...

Whisper_Bully

Whisper Bully Bluetooth BDADDR Extraction, Denial-of-Service & Hijack Research Tool © 2026 @Ymsniper — For authorized security research only. Overview Whisper Bully is a three-stage Bluetooth security research tool targeting devices that advertise Google Fast Pair service UUID fe2c. It demonstrat...

CVE-2017-0541

poc and vulnerability analysis of CVE-2017-0541...

CVE-2022-39227

This repo belongs to https://github.com/user0x1337/CVE-2022-39227 I just copy it...

CVE-2014-0224

This repository does not have a README...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: do not add sk to the parent socket’s accept queue unless BTLISTEN is set. The new sk should not be added to the parent socket’s accept queue after last l2capsockcleanuplisten has been executed in...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

SUSE CVE-2026-99239

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...

K000164083: Linux kernel vulnerability CVE-2026-53071

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2capecredreconfrsp l2capecredreconfrsp calls l2capchandel without holding l2capchanlock. Every other l2capchandel caller in the file acquires the lock firs...

CVE-2026-99239

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...

CVE-2026-99239

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP subsystem. A race condition between concurrent socket bind and connect operations allows a communication channel to be attached to a connection multiple times. A local attacker can exploit this fla...

DEBIAN-CVE-2026-99239

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...