CVE-2026-105460: BlueZ btmon Buffer Overflow Vulnerability

CVE-2026-105460 Overview

A flaw exists in BlueZ, the official Linux Bluetooth protocol stack. The btmon Bluetooth monitor tool contains an out-of-bounds read vulnerability when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can declare a link-key count that exceeds the actual packet data. The tool then reads beyond the allocated buffer and crashes. The flaw is tracked under CWE-125 (Out-of-Bounds Read).

Critical Impact
Local attackers can trigger a denial-of-service condition in btmon by convincing an operator to open a malicious btsnoop capture file.

Affected Products

BlueZ (Linux Bluetooth protocol stack)
btmon Bluetooth monitor utility
Linux distributions bundling vulnerable BlueZ builds (see Red Hat CVE-2026-105460 Advisory)

Discovery Timeline

2026-10-13 - CVE CVE-2026-105460 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-105460

Vulnerability Analysis

The vulnerability resides in the HCI Return Link Keys event parser used by btmon. The event structure contains a field that specifies the number of link keys encoded within the packet. The parser trusts this count without validating it against the remaining packet length. When the attacker-controlled count exceeds the real buffer size, the parsing loop reads past the end of the allocated memory region.

Because btmon is a diagnostic monitor rather than a privileged daemon, exploitation is limited to the process reading the capture. The resulting read of unmapped or adjacent memory produces a crash and terminates the monitoring session.

Root Cause

The root cause is missing bounds validation between the declared number of link keys in the HCI Return Link Keys event and the actual packet payload length. The code iterates the declared count and dereferences bytes that may lie outside the input buffer.

Attack Vector

Exploitation requires local access and user interaction. An attacker crafts a malicious btsnoop capture file containing a Return Link Keys event with an inflated key count. The attacker then delivers this file to a target user who opens it with btmon, for example via btmon -r malicious.snoop. Parsing triggers the out-of-bounds read and crashes the utility. Confidentiality and integrity are not impacted; availability of the monitoring tool is lost for the duration of the session.

No verified public exploit code is available. See the Red Hat Bug Report #2545923 for triage detail.

Detection Methods for CVE-2026-105460

Indicators of Compromise

Unexpected termination or segmentation faults of the btmon process during capture replay
Presence of untrusted .snoop or .btsnoop files staged in user-writable directories
Shell history or audit records showing btmon -r invocations against externally sourced capture files

Detection Strategies

Hunt for process crash events where the terminated binary is btmon and the parent command line references an external capture path
Correlate file-write events for btsnoop captures from non-standard sources with subsequent btmon executions
Review Linux coredumpctl or systemd-coredump entries referencing BlueZ components

Monitoring Recommendations

Enable auditd rules on BlueZ user-space binaries to log execution with file arguments
Alert on repeated btmon crashes across one or more Linux hosts within a short window
Monitor delivery channels (email attachments, shared storage) for .snoop and .btsnoop file transfers

How to Mitigate CVE-2026-105460

Immediate Actions Required

Avoid opening untrusted btsnoop capture files with btmon until a patched BlueZ build is installed
Inventory Linux systems with BlueZ installed, prioritizing engineering, QA, and Bluetooth development hosts
Track vendor updates through the Red Hat CVE-2026-105460 Advisory and the Red Hat PSIRT SUPPT-24932 Ticket

Patch Information

At the time of publication, upstream BlueZ patches should be consumed from the maintaining distribution. Red Hat is tracking remediation under Bug Report #2545923. Apply distribution updates for BlueZ once vendors publish fixed packages.

Workarounds

Restrict execution of btmon to trusted administrators and known-good capture files
Validate the provenance of btsnoop files before replay, preferring captures generated on-host
Remove the BlueZ utilities package from systems that do not require Bluetooth protocol analysis

bash

# Example: query installed BlueZ version and remove utilities where unused
rpm -q bluez bluez-tools 2>/dev/null || dpkg -l | grep -i bluez

# Red Hat / Fedora based systems
sudo dnf remove bluez-tools

# Debian / Ubuntu based systems
sudo apt-get remove bluez-tools