CVE-2023-2002

Linux Bluetooth: 未承認の管理コマンド実行 CVE-2023-2002...

CVE-2026-80692

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

Linux Distros Unpatched Vulnerability : CVE-2026-80692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount t...

The vulnerability of the btintelHW_error() function in the drivers/bluetooth/btintel.c module of the Linux Bluetooth device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the btintelHWerror function in the drivers/bluetooth/btintel.c module of the Linux Bluetooth device driver is related to synchronization errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

The vulnerability of the btusb_work() function in the drivers/bluetooth/btusb.c module of the Linux Bluetooth device driver allows a attacker to cause a service failure.

The vulnerability of the btusbwork function in the drivers/bluetooth/btusb.c module of the Linux Bluetooth device driver lies in a buffer overflow in the dynamic memory. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the l2cap_ecred_conn_req() function in the net/bluetooth/l2cap_core.c module of the Linux kernel’s Bluetooth subsystem allows a attacker to access protected information or cause service failures.

The vulnerability of the l2capecredconnreq function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to gain access to protected...

The vulnerability of the btusb_mtk_claim_iso_intf() function in the drivers/bluetooth/btusb.c module of the Linux Bluetooth kernel driver allows a hacker to cause a service failure.

The vulnerability of the btusbmtkclaimisointf function in the drivers/bluetooth/btusb.c module of the Linux Bluetooth device driver relates to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the hci_abort_conn_sync() function in the net/bluetooth/hciSync.c module of the Bluetooth subsystem in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hciabortconnsync function in the net/bluetooth/hciSync.c module of the Bluetooth subsystem in the Linux operating system is related to the reutilization of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Linux Distros Unpatched Vulnerability : CVE-2026-53208

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/bluetooth/l2capcore.c:l2capsigchannel accepts BR/EDR signaling packets up to the channel MTU a...

Linux Distros Unpatched Vulnerability : CVE-2026-52918

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: serialize acceptq access btsockpoll walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last...

CVE-2026-31771

A flaw was found in the Linux kernel's Bluetooth subsystem. A remote attacker could exploit a missing bounds check by sending a specially crafted, short Bluetooth Host Controller Interface HCI event frame. This could lead to a buffer overflow, potentially allowing the attacker to cause a denial o...

The vulnerability of the hci_devcd_dump() function in the net/bluetooth/coredump.c module of the Linux operating system’s Bluetooth subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hcidevcddump function in the net/bluetooth/coredump.c module of the Linux operating system’s Bluetooth subsystem is related to buffer out-of-buffer reading. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibili...

The vulnerability of the hidp_set_timer() function in the net/bluetooth/hidp/core.c module of the Linux kernel’s Bluetooth subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hidpsettimer function in the net/bluetooth/hidp/core.c module of the Linux kernel’s Bluetooth subsystem is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility...

The vulnerability of the hci_conn_del() function in the net/bluetooth/hci_conn.c module of the Linux kernel’s Bluetooth subsystem allows a attacker to cause a service failure.

The vulnerability of the hciconndel function in the net/bluetooth/hciconn.c module of the Bluetooth subsystem in the Linux operating system is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow a attacker to cause service failures...

The vulnerability of the bcsp_recv() function in the drivers/bluetooth/hci_bcsp.c module of the Linux Bluetooth device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the bcsprecv function in the drivers/bluetooth/hcibcsp.c module of the Linux Bluetooth device driver framework is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

ROS-20260129-73-0013

A vulnerability in the OBEX protocol implementation of the Bluetooth protocol stack for Linux BlueZ is related to reading outside the valid range. Exploitation of the vulnerability could allow a remote attacker to gain access to protected information...

CVE-2025-40294 Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parseadvmonitorpattern In the parseadvmonitorpattern function, the value of the 'length' variable is currently limited to HCIMAXEXTADLENGTH251. The size of the 'value' array in the mgmtadvpatter...

Vulnerability of the btmtk_usb_isointf_init() function in the drivers/bluetooth/btmtk.c module – This driver for Bluetooth devices in Linux allows a hacker to cause a service failure.

Vulnerability of the btmtkusbisointfinit function in the drivers/bluetooth/btmtk.c module – The Bluetooth device support driver in Linux operating systems relies on pointer swapping. Exploiting this vulnerability could allow an attacker to cause a service failure...

Siemens SIMATIC S7-1500 Use After Free (CVE-2023-40283)

An issue was discovered in l2capsockrelease in net/bluetooth/l2capsock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Siemens SIMATIC Devices Race Condition (CVE-2024-24857)

A race condition was found in the Linux kernel's net/bluetooth device driver in conninfomin,maxageset function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service. This plugin only works with Tenable.ot. Please visit...