Loading story…
The Linux kernel received a patch for a Bluetooth vulnerability tied to improper handling of fragmented packets, while independent research described a related "Frag Gap" issue that could let attackers abuse fragmentation behavior to bypass expected protocol protections. The available references indicate the flaw affects low-level packet reassembly logic and could expose systems using Bluetooth to unintended packet acceptance or security control evasion.
The public reporting links the issue to wireless fragmentation weaknesses similar in concept to earlier FragAttacks research, with the kernel commit serving as the upstream remediation path and the technical write-up providing exploit context. For defenders, the immediate implication is to prioritize Linux kernel updates on Bluetooth-enabled systems and review exposure in environments where nearby attackers could interact over wireless interfaces.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A Linux kernel git commit associated with the story was published in the upstream repository, indicating code changes related to the issue. The reference does not provide an explicit event date in the supplied content.
A blog post titled "Frag Gap" was published describing the issue and related technical details. The reference provides an explicit publication timestamp for the post.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two Linux kernel vulnerabilities, **CVE-2026-53362** and **CVE-2026-53366**, were disclosed in the UDP packet handling path and can allow a local unprivileged user to escalate privileges to root. The flaws affect the IPv6 UDPv6 path and the IPv4 UDP path when `MSG_SPLICE_PAGES` is used with UDP corking and a datagram crosses a fragment boundary, causing a heap out-of-bounds write. Researchers said incorrect `fraggap` accounting lets validation be bypassed, leading to corruption of `skb_shared_info` metadata and manipulation of the `nr_frags` field, which can ultimately produce a use-after-free condition exploitable for local privilege escalation. The bugs affect Linux kernels from **v6.1 onward**. The IPv6 issue requires `CONFIG_IPV6=y`, while the IPv4 variant also depends on access conditions tied to user namespaces. Fixes were published in upstream commits `736b380e28d0` for IPv6 and `eca856950f7c` for IPv4, and were released in stable kernel versions including **7.1.3, 6.18.38, 6.12.95, 6.6.144, and 6.1.177**. Advisories or updates were issued by major distributions including **Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, and Fedora**.
Jul 23, 2026
Armis Labs disclosed **BlueBorne**, a cluster of Bluetooth implementation vulnerabilities that exposed Android, Windows, Linux, older iOS versions, and some older macOS systems to attack without pairing, user interaction, or even an IP connection. The flaws, reported as eight to nine bugs across affected platforms, included **remote code execution**, **man-in-the-middle**, **information disclosure**, and full device takeover scenarios. Researchers said an infected device could invisibly reach nearby targets over Bluetooth from roughly 32 feet away, potentially intercept data, deliver malware, and spread in a worm-like fashion across phones, PCs, smartwatches, TVs, cars, drones, medical devices, and other IoT systems. At disclosure, Armis estimated **5.3 billion devices** were vulnerable, and US-CERT warned that millions of unpatched systems could be affected. Although patches were issued for some platforms, including Microsoft Windows and newer Android releases, older Android devices, many Linux systems, and unsupported Apple devices remained difficult to secure. A year after the flaws were revealed, Armis said **more than two billion devices** were still exposed because users had not installed updates or their hardware no longer received vendor support, underscoring the long tail of Bluetooth risk across legacy and embedded systems.
Jun 29, 2026
Researchers disclosed three vulnerabilities in Bluetooth audio devices built on Airoha systems-on-chip that can allow an attacker within radio range to gain unauthorized access to device memory and communications. The flaws, tracked as **`CVE-2025-20700`**, **`CVE-2025-20701`**, and **`CVE-2025-20702`**, stem from missing authentication in GATT and Bluetooth BR/EDR components and weak permission controls in a proprietary protocol, affecting headphones and earbuds sold by brands including **Sony, Bose, Jabra, JBL, Marshall, Beyerdynamic, and Teufel**. ERNW researchers said the bugs can be chained to hijack the Bluetooth link between a phone and an audio device, issue commands to the paired phone through the **Hands-Free Profile**, eavesdrop on conversations, and potentially overwrite firmware for remote code execution on the accessory. The attack requires proximity because exploitation is limited by Bluetooth range, but defenders were urged to apply vendor firmware updates and investigate or restart devices showing abnormal Bluetooth behavior.
Jul 24, 2026