CVE-2006-6106
Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net...
7.5 High
CVE-2006-6106 is a high vulnerability (CVSS 7.5) in Linux Kernel, published December 19, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.79%, the 93rd percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 5.79%EPSS, 93rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net/bluetooth/cmtp/capi.c) in the Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 before 2.6.18.6, and 2.6.19.x, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via CAPI messages with a large value for the length of the (1) manu (manufacturer) or (2) serial (serial number) field.
Exploit likelihood
5.79%Down 2.4 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kernel-source-2.6.8Debian:3.1 From an advisory covering 14 CVEs | before 2.6.8-16sarge7, plus listed versions 2.6.8-162.6.8-16sarge12.6.8-16sarge22.6.8-16sarge32.6.8-16sarge42.6.8-16sarge52.6.8-16sarge6 | 2.6.8-16sarge7 |
kernel-latest-2.4-i386Debian:3.1 From an advisory covering 20 CVEs | before 101sarge2, plus listed versions 101101sarge1 | 101sarge2 |
kernel-image-2.4.27-alphaDebian:3.1 From an advisory covering 20 CVEs | before 2.4.27-10sarge6, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge22.4.27-10sarge32.4.27-10sarge42.4.27-10sarge5 | 2.4.27-10sarge6 |
kernel-image-2.4.27-m68kDebian:3.1 From an advisory covering 20 CVEs | before 2.4.27-3sarge6, plus listed versions 2.4.27-32.4.27-3sarge12.4.27-3sarge22.4.27-3sarge32.4.27-3sarge42.4.27-3sarge5 | 2.4.27-3sarge6 |
i2cDebian:3.1 From an advisory covering 20 CVEs | before 1:2.9.1-1sarge2, plus listed versions 1:2.9.1-11:2.9.1-1sarge1 | 1:2.9.1-1sarge2 |
systemimagerDebian:3.1 From an advisory covering 20 CVEs | before 3.2.3-6sarge5, plus listed versions 3.2.3-63.2.3-6sarge13.2.3-6sarge23.2.3-6sarge33.2.3-6sarge4 | 3.2.3-6sarge5 |
kernel-latest-2.4-alphaDebian:3.1 From an advisory covering 20 CVEs | before 101sarge3, plus listed versions 101101sarge1 | 101sarge3 |
kernel-patch-powerpc-2.4.27Debian:3.1 From an advisory covering 20 CVEs | before 2.4.27-10sarge6, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge22.4.27-10sarge32.4.27-10sarge42.4.27-10sarge5 | 2.4.27-10sarge6 |
kernel-latest-2.4-sparcDebian:3.1 From an advisory covering 20 CVEs | before 42sarge3, plus listed versions 4242sarge142sarge2 | 42sarge3 |
kernel-patch-2.4.27-mipsDebian:3.1 From an advisory covering 20 CVEs | before 2.4.27-10.sarge4.040815-3, plus listed versions 2.4.27-10.040815-12.4.27-10.sarge1.040815-12.4.27-10.sarge2.040815-12.4.27-10.sarge3.040815-12.4.27-10.sarge4.040815-12.4.27-10.sarge4.040815-2 | 2.4.27-10.sarge4.040815-3 |
Show 52 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pcmcia-modules-2.4.27-i386Debian:3.1 From an advisory covering 20 CVEs | before 3.2.5+2sarge2, plus listed versions 3.2.5+23.2.5+2sarge1 | 3.2.5+2sarge2 |
kernel-image-2.4.27-ia64Debian:3.1 From an advisory covering 20 CVEs | before 2.4.27-10sarge6, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge22.4.27-10sarge32.4.27-10sarge42.4.27-10sarge5 | 2.4.27-10sarge6 |
mindi-kernelDebian:3.1 From an advisory covering 20 CVEs | before 2.4.27-2sarge5, plus listed versions 2.4.27-22.4.27-2sarge12.4.27-2sarge22.4.27-2sarge32.4.27-2sarge4 | 2.4.27-2sarge5 |
kernel-latest-2.4-s390Debian:3.1 From an advisory covering 20 CVEs | before 2.4.27-1sarge2, plus listed versions 2.4.27-12.4.27-1sarge1 | 2.4.27-1sarge2 |
hostap-modules-i386Debian:3.1 From an advisory covering 20 CVEs | before 1:0.3.7-1sarge3, plus listed versions 1:0.3.7-11:0.3.7-1sarge11:0.3.7-1sarge2 | 1:0.3.7-1sarge3 |
kernel-image-speakup-i386Debian:3.1 From an advisory covering 20 CVEs | before 2.4.27-1.1sarge5, plus listed versions 2.4.27-1.12.4.27-1.1sarge12.4.27-1.1sarge22.4.27-1.1sarge32.4.27-1.1sarge4 | 2.4.27-1.1sarge5 |
kernel-source-2.4.27Debian:3.1 From an advisory covering 20 CVEs | before 2.4.27-10sarge6, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge22.4.27-10sarge32.4.27-10sarge42.4.27-10sarge5 | 2.4.27-10sarge6 |
kernel-image-2.4.27-armDebian:3.1 From an advisory covering 20 CVEs | before 2.4.27-2sarge6, plus listed versions 2.4.27-22.4.27-2sarge12.4.27-2sarge22.4.27-2sarge32.4.27-2sarge42.4.27-2sarge5 | 2.4.27-2sarge6 |
kernel-image-2.4.27-i386Debian:3.1 From an advisory covering 20 CVEs | before 2.4.27-10sarge6, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge22.4.27-10sarge32.4.27-10sarge42.4.27-10sarge5 | 2.4.27-10sarge6 |
kernel-image-2.4.27-sparcDebian:3.1 From an advisory covering 20 CVEs | before 2.4.27-9sarge6, plus listed versions 2.4.27-92.4.27-9sarge12.4.27-9sarge22.4.27-9sarge32.4.27-9sarge42.4.27-9sarge5 | 2.4.27-9sarge6 |
kernel-image-2.4.27-s390Debian:3.1 From an advisory covering 20 CVEs | before 2.4.27-2sarge6, plus listed versions 2.4.27-22.4.27-2sarge12.4.27-2sarge22.4.27-2sarge32.4.27-2sarge42.4.27-2sarge5 | 2.4.27-2sarge6 |
kernel-source-2.4.27Debian:3.1 From an advisory covering 20 CVEs | before 2.4.27-10sarge7, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge22.4.27-10sarge32.4.27-10sarge42.4.27-10sarge52.4.27-10sarge6 | 2.4.27-10sarge7 |
kernelRed Hat:enterprise_linux:4::as From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-develRed Hat:enterprise_linux:4::as From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-docRed Hat:enterprise_linux:4::as From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-hugememRed Hat:enterprise_linux:4::as From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-hugemem-develRed Hat:enterprise_linux:4::as From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-largesmpRed Hat:enterprise_linux:4::as From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-largesmp-develRed Hat:enterprise_linux:4::as From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-smpRed Hat:enterprise_linux:4::as From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-smp-develRed Hat:enterprise_linux:4::as From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernelRed Hat:enterprise_linux:4::desktop From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-develRed Hat:enterprise_linux:4::desktop From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-docRed Hat:enterprise_linux:4::desktop From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-hugememRed Hat:enterprise_linux:4::desktop From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-hugemem-develRed Hat:enterprise_linux:4::desktop From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-largesmpRed Hat:enterprise_linux:4::desktop From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-largesmp-develRed Hat:enterprise_linux:4::desktop From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-smpRed Hat:enterprise_linux:4::desktop From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-smp-develRed Hat:enterprise_linux:4::desktop From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernelRed Hat:enterprise_linux:4::es From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-develRed Hat:enterprise_linux:4::es From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-docRed Hat:enterprise_linux:4::es From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-hugememRed Hat:enterprise_linux:4::es From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-hugemem-develRed Hat:enterprise_linux:4::es From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-largesmpRed Hat:enterprise_linux:4::es From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-largesmp-develRed Hat:enterprise_linux:4::es From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-smpRed Hat:enterprise_linux:4::es From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-smp-develRed Hat:enterprise_linux:4::es From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernelRed Hat:enterprise_linux:4::ws From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-develRed Hat:enterprise_linux:4::ws From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-docRed Hat:enterprise_linux:4::ws From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-hugememRed Hat:enterprise_linux:4::ws From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-hugemem-develRed Hat:enterprise_linux:4::ws From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-largesmpRed Hat:enterprise_linux:4::ws From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-largesmp-develRed Hat:enterprise_linux:4::ws From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-smpRed Hat:enterprise_linux:4::ws From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
kernel-smp-develRed Hat:enterprise_linux:4::ws From an advisory covering 15 CVEs | before 0:2.6.9-42.0.8.EL | 0:2.6.9-42.0.8.EL |
What each source reports
NVD Score used
Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net/bluetooth/cmtp/capi.c) in the Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 before 2.6.18.6, and 2.6.19.x, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via CAPI messages with a large value for the length of the (1) manu (manufacturer) or (2) serial (serial number) field.
- Record
CVE-2006-6106- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net/bluetooth/cmtp/capi.c) in the Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 before 2.6.18.6, and 2.6.19.x, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via CAPI messages with a large value for the length of the (1) manu (manufacturer) or (2) serial (serial number) field.
- Record
CVE-2006-6106- Updated
- 2026-11-02
EUVDEUVD-2006-6089No score
Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net/bluetooth/cmtp/capi.c) in the Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 before 2.6.18.6, and 2.6.19.x, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via CAPI messages with a large value for the length of the (1) manu (manufacturer) or (2) serial (serial number) field.
- Record
EUVD-2006-6089- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q277-f5pv-phh4No score
Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net...
Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net/bluetooth/cmtp/capi.c) in the Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 before 2.6.18.6, and 2.6.19.x, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via CAPI messages with a large value for the length of the (1) manu (manufacturer) or (2) serial (serial number) field.
- Record
GHSA-q277-f5pv-phh4- Weakness
- CWE-119
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
trustix.org/errata/2007/0002
secunia.com/advisories/24098
vupen.com/english/advisories/2006/5037
mandriva.com/security/advisories?name=MDKSA-2007:025
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10891
Show 115 moreShow less
novell.com/linux/security/advisories/2007_53_kernel.html
rhn.redhat.com/errata/RHSA-2007-0014.html
support.avaya.com/elmodocs2/security/ASA-2007-063.htm
ubuntu.com/usn/usn-416-1
securityfocus.com/archive/1/459615/100/0/threaded
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218602
debian.org/security/2008/dsa-1503
marc.info?l=linux-kernel&m=116648929829440&w=2
exchange.xforce.ibmcloud.com/vulnerabilities/30912
kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.33.5
issues.rpath.com/browse/RPL-848
nvd.nist.gov/vuln/detail/CVE-2006-6106
github.com/advisories/GHSA-q277-f5pv-phh4
access.redhat.com/errata/RHSA-2007:0014
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0014.json
cve.org/CVERecord?id=CVE-2006-4538