CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom

CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom A Bluetooth Classic RFCOMM service of Parani M10 Intercom is exposed without enforcing secure authentication or proper access control. Once within range, any device can Establish a connection without proper...

CVE-2025-13834-A-Bluetooth-RFCOMM-Out-of-Bounds-Read-Vulnerability-in-Modern-Wireless-Devices

= doi.org/10.5281/zenodo.18323302 = orcid.org/0009-0007-7728-256X README.md: CVE-2025-13834 RFCOMM Bluetooth "Heartbleed" Exploitation Framework Author: Sastra Adi Wiguna Purple Elite Teaming Date: January 20, 2026 Version: 1.0 Full-System Replication License: RED TEAM USE ONLY Do not distribute...

CVE-2026-99010

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

CVE-2026-99010 Bluetooth: RFCOMM: free the skb when the DLC has no owner

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

EUVD-2026-108804

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

CVE-2026-99010

The Linux kernel Bluetooth RFCOMM component contains a memory leak vulnerability. The issue occurs in rfcomm_recv_data() when a Data Link Control (DLC) has no owner (e.g., after rfcomm_sock_destruct() clears d->owner but before the session closes). In the socket implementation, the skb is hand...

EUVD-2026-108803

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

CVE-2026-99009

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

CVE-2026-99009 Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

CVE-2026-99009

The Linux kernel contains a circular locking dependency vulnerability in the Bluetooth RFCOMM component. The issue arises because an RFCOMM connect() from userspace acquires rfcomm_mutex before hdev->lock, while the HCI event path (via rfcomm_security_cfm()) acquires them in the opposite order...

EUVD-2026-108802

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed. rfcommdevadd puts the new device on rfcommdevlist first and only then...

CVE-2026-99008

The Linux kernel contains a NULL pointer dereference vulnerability in the Bluetooth RFCOMM component. The issue occurs in rfcomm_dev_shutdown() when an RFCOMM tty is closed. Specifically, rfcomm_dev_add() adds a device to the list before registering the tty device; if registration fails, dev->...

CVE-2026-99008

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed. rfcommdevadd puts the new device on rfcommdevlist first and only then...

CVE-2026-99008 Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed. rfcommdevadd puts the new device on rfcommdevlist first and only then...

CVE-2026-98739

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A local user could exploit this flaw to cause a Denial of Service DoS or potentially escalate privileges. A race condition between concurrent device installation and release operations allows reference counts to be dropped...

SUSE CVE-2026-98739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...

CVE-2026-80819

A flaw was found in the Bluetooth RFCOMM Radio Frequency Communication subsystem of the Linux kernel. A remote attacker can send a specially crafted Bluetooth Disconnect DISC message to a device with a deferred RFCOMM channel. This can lead to a null pointer dereference when the system attempts t...

CVE-2026-98600

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. This vulnerability allows an adjacent attacker within Bluetooth range to cause a Denial of Service DoS by transmitting a specially crafted frame with an extended length field. Because the kernel fails...

Linux Distros Unpatched Vulnerability : CVE-2026-98600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifie...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53254)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb-data to protocol-specific structs without validating skb-len first. A malicious remote device can send truncated MCC frames and trigger...