CVE-2025-13834-A-Bluetooth-RFCOMM-Out-of-Bounds-Read-Vulnerability-in-Modern-Wireless-Devices

= doi.org/10.5281/zenodo.18323302 = orcid.org/0009-0007-7728-256X README.md: CVE-2025-13834 RFCOMM Bluetooth "Heartbleed" Exploitation Framework Author: Sastra Adi Wiguna Purple Elite Teaming Date: January 20, 2026 Version: 1.0 Full-System Replication License: RED TEAM USE ONLY Do not distribute...

CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom

CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom A Bluetooth Classic RFCOMM service of Parani M10 Intercom is exposed without enforcing secure authentication or proper access control. Once within range, any device can Establish a connection without proper...

kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A malicious remote device could exploit this vulnerability by sending specially crafted, truncated Multiplexing Control Channel MCC frames. This lack of proper validation of incoming data length befor...

kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A malicious remote device could exploit this vulnerability by sending specially crafted, truncated Multiplexing Control Channel MCC frames. This lack of proper validation of incoming data length befor...

CVE-2026-77685

The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BTRFCOMMTEST command as buf-len - 1 and passed it to rfcommsendtest, whose length parameter is a uint8t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf-len == 0 aft...

CVE-2026-77685

The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BTRFCOMMTEST command as buf-len - 1 and passed it to rfcommsendtest, whose length parameter is a uint8t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf-len == 0 aft...

CVE-2026-77685

A vulnerability exists in the Bluetooth Classic RFCOMM multiplexer control-channel handler (rfcomm.c). An integer underflow occurs when processing a malformed BT_RFCOMM_TEST command: if the buf->len is 0, the calculation buf->len - 1 underflows to 255. This causes rfcomm_send_test() to perf...

CVE-2026-77685 Bluetooth Classic RFCOMM: integer underflow in the MCC TEST command handler leads to out-of-bounds read disclosed to the peer and out-of-bounds write

The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BTRFCOMMTEST command as buf-len - 1 and passed it to rfcommsendtest, whose length parameter is a uint8t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf-len == 0 aft...

CVE-2026-77685 Bluetooth Classic RFCOMM: integer underflow in the MCC TEST command handler leads to out-of-bounds read disclosed to the peer and out-of-bounds write

The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BTRFCOMMTEST command as buf-len - 1 and passed it to rfcommsendtest, whose length parameter is a uint8t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf-len == 0 aft...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session in sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

Astra Linux – vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in settermios rfcommttysettermios tests dlc-session without rfcommmutex and later passes the pointer to rfcommsendrpn. The latter dereferences both session-initiator and session-sock. Meanwhile,...

CVE-2026-93783

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. This vulnerability allows an attacker within Bluetooth range to cause a Denial of Service DoS or trigger an information disclosure by transmitting specially crafted, truncated, or zero-length frames...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcommsockcleanuplisten closes unaccepted child sockets via rfcommsockclose, which acquires the child socket lock prior to rfcommdlcclose acquiring the rfcommmute...

CVE-2026-99008

A flaw was found in the Linux kernel's Bluetooth subsystem. When an RFCOMM Radio Frequency Communication terminal device fails to register properly during initialization, closing the device triggers a null pointer dereference in the shutdown handler. A local attacker could exploit this...

CVE-2026-99010

A flaw was found in the Linux kernel's Bluetooth Radio Frequency Communication RFCOMM subsystem. When a communication socket is closed while the underlying connection session remains active, incoming data packets are not released from memory. A remote attacker can exploit this vulnerability by...

CVE-2026-99009

A flaw was found in the Linux kernel's Bluetooth Radio Frequency Communication RFCOMM subsystem. A circular locking dependency can occur when an RFCOMM connection is initiated while a Bluetooth link is undergoing authentication or encryption. A local user can exploit this issue to trigger a...