CVE-2026-75032: BlueZ AVRCP DoS Vulnerability

CVE-2026-75032 Overview

A flaw exists in BlueZ, the official Linux Bluetooth protocol stack. The vulnerability stems from insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation. A malicious Bluetooth device within radio range can trigger an out-of-bounds memory read in the parse_media_element() and parse_media_folder() functions. Successful exploitation crashes the bluetoothd daemon, producing a Denial of Service condition. The flaw may also expose sensitive heap memory contents to the attacker. Exploitation requires user interaction to pair with the malicious Bluetooth device.

Critical Impact
An adjacent attacker who convinces a user to pair with a malicious Bluetooth device can crash bluetoothd and potentially read adjacent heap memory, causing service disruption and possible information disclosure.

Affected Products

BlueZ Linux Bluetooth protocol stack
Linux distributions shipping vulnerable BlueZ builds (see Red Hat advisory)
Systems using the AVRCP profile through bluetoothd

Discovery Timeline

2026-08-18 - CVE-2026-75032 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75032

Vulnerability Analysis

The vulnerability resides in the AVRCP browsing feature handled by bluetoothd. AVRCP allows a Bluetooth controller to browse and manipulate media items exposed by a target device. When the daemon receives a GetFolderItems response, the parser walks a sequence of media element and media folder structures encoded with length-prefixed fields. The functions parse_media_element() and parse_media_folder() fail to verify that declared field lengths remain within the received buffer. A crafted response with oversized or truncated length values drives the parser past the end of the allocated buffer, producing an out-of-bounds read classified as [CWE-125].

The primary impact is a crash of bluetoothd, which terminates active Bluetooth services on the host. Because the read occurs against heap memory adjacent to the response buffer, the contents may be reflected back to the attacker or logged, creating an information disclosure path alongside the Denial of Service.

Root Cause

The root cause is missing bounds validation. The AVRCP browsing parsers trust attacker-controlled length fields inside GetFolderItems responses instead of clamping them against the remaining buffer length before dereferencing.

Attack Vector

Exploitation requires proximity within Bluetooth radio range and user interaction to complete pairing with the malicious device. Once paired, the attacker sends a crafted AVRCP GetFolderItems response with manipulated length fields, triggering the out-of-bounds read inside parse_media_element() or parse_media_folder(). No authentication credentials are required beyond the pairing action performed by the victim.

No verified public proof-of-concept is available. See the Red Hat CVE-2026-75032 Advisory and Red Hat Bug Report #2517490 for technical details.

Detection Methods for CVE-2026-75032

Indicators of Compromise

Unexpected crashes or restarts of the bluetoothd daemon in systemd journal or syslog.
Core dumps referencing parse_media_element() or parse_media_folder() within the BlueZ AVRCP code path.
Pairing events with unknown or untrusted Bluetooth devices immediately preceding daemon failure.

Detection Strategies

Monitor systemd unit status for bluetooth.service transitioning to failed state or repeated restart loops.
Alert on new Bluetooth pairing events on servers, kiosks, and workstations where Bluetooth is not part of normal operations.
Correlate bluetoothd termination signals (SIGSEGV, SIGABRT) with recent AVRCP browsing traffic.

Monitoring Recommendations

Enable AddressSanitizer or equivalent instrumentation in test environments to surface out-of-bounds reads during regression runs.
Collect Bluetooth Host Controller Interface (HCI) logs on high-value endpoints for post-incident analysis.
Track patch state of the bluez package across the fleet through configuration management inventory.

How to Mitigate CVE-2026-75032

Immediate Actions Required

Apply vendor-supplied BlueZ updates as soon as they are published for your distribution.
Disable the Bluetooth service on systems that do not require it using systemctl disable --now bluetooth.
Instruct users not to pair with unknown Bluetooth devices, especially in public environments.

Patch Information

Refer to the Red Hat CVE-2026-75032 Advisory for fixed package versions and backports. Distribution maintainers are expected to ship updated bluez packages that add bounds checks to parse_media_element() and parse_media_folder() when handling GetFolderItems responses.

Workarounds

Stop and mask the Bluetooth service on hosts that do not need it: systemctl mask bluetooth.service.
Remove the AVRCP plugin from bluetoothd startup where the profile is not required.
Restrict device discoverability and pairing to trusted operators through endpoint policy.

bash

# Disable and mask the Bluetooth daemon where not required
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
sudo systemctl mask bluetooth.service

# Verify the daemon is no longer running
systemctl status bluetooth.service