CVE-2026-80185: BlueZ bluetoothd DoS Vulnerability

CVE-2026-80185 Overview

CVE-2026-80185 is a type confusion vulnerability [CWE-843] in the BlueZ Bluetooth stack, specifically within the sdp-xml.c Service Discovery Protocol (SDP) XML parser. A local caller can invoke RegisterProfile with a crafted nested ServiceRecord to corrupt the parser stack. The corruption causes scalar union data to be interpreted as a sequence pointer, crashing the bluetoothd daemon. The result is a local denial of service against the Bluetooth subsystem on affected Linux systems.

Critical Impact
A local authenticated caller on an adjacent network can crash bluetoothd, disabling Bluetooth services until the daemon is restarted.

Affected Products

BlueZ (Linux Bluetooth protocol stack)
Linux distributions shipping vulnerable BlueZ builds (see Red Hat advisory)
Systems exposing the D-Bus RegisterProfile interface to local callers

Discovery Timeline

2026-08-25 - CVE-2026-80185 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80185

Vulnerability Analysis

The flaw resides in the SDP XML parsing logic in sdp-xml.c. BlueZ exposes the RegisterProfile D-Bus method, which accepts a ServiceRecord XML payload describing a Bluetooth service. The parser maintains a stack representing nested XML elements and tracks whether each level holds scalar union data or a sequence container.

When an attacker submits a crafted nested ServiceRecord, the parser mismanages type tracking on this stack. Subsequent processing treats a scalar union value as if it were a pointer to a sequence structure. Dereferencing the mistyped value crashes bluetoothd.

The issue is classified as type confusion [CWE-843]. Exploitation does not yield code execution or data disclosure, but it terminates the Bluetooth service, denying availability to all local users and paired devices.

Root Cause

The root cause is inconsistent type tagging in the SDP XML parser's element stack. The parser fails to validate that a stack frame's declared type matches the union member accessed during nested element handling. This allows a scalar value to be dereferenced as a sequence pointer.

Attack Vector

Exploitation requires local access with permission to call the BlueZ D-Bus interface. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects the adjacent-network attack surface, low privilege requirement, and high availability impact. The attacker invokes RegisterProfile with a malformed nested ServiceRecord payload. No user interaction is required. The vulnerability affects only availability; confidentiality and integrity are unaffected.

No public proof-of-concept exploit is available at this time. Technical details are described in the Red Hat CVE-2026-80185 Advisory and Red Hat Bug Report #2524139.

Detection Methods for CVE-2026-80185

Indicators of Compromise

Unexpected bluetoothd process crashes or segmentation faults recorded in journalctl -u bluetooth or dmesg
systemd restart events for the bluetooth.service unit without administrator action
D-Bus calls to org.bluez.ProfileManager1.RegisterProfile from unexpected local processes
Core dumps generated by bluetoothd referencing sdp-xml.c in the stack trace

Detection Strategies

Monitor systemd journal entries for bluetoothd termination events and correlate with the invoking UID and D-Bus sender
Audit D-Bus method invocations to org.bluez interfaces using dbus-monitor or auditd rules on /var/run/dbus/system_bus_socket
Enable core dump collection for bluetoothd and inspect for the mistyped dereference pattern in sdp-xml.c

Monitoring Recommendations

Alert on repeated bluetooth.service restarts within short intervals, which may indicate exploitation attempts
Track processes that call RegisterProfile and baseline expected callers on managed endpoints
Forward BlueZ crash telemetry to a centralized log platform for correlation across the fleet

How to Mitigate CVE-2026-80185

Immediate Actions Required

Apply the patched BlueZ package from your Linux distribution as soon as it is available; monitor the Red Hat CVE-2026-80185 Advisory for fix status
Restrict D-Bus policy to allow org.bluez.ProfileManager1.RegisterProfile invocation only from trusted UIDs or system services
On systems that do not require Bluetooth, mask the bluetooth.service unit to remove the attack surface

Patch Information

At publication time, refer to the Red Hat CVE-2026-80185 Advisory and Red Hat Bug Report #2524139 for package versions and errata. Apply distribution updates to bluez as soon as they are published.

Workarounds

Disable and stop the bluetooth.service unit on systems that do not require Bluetooth functionality
Tighten /etc/dbus-1/system.d/bluetooth.conf to deny RegisterProfile calls from untrusted users and groups
Remove untrusted local users from groups that grant BlueZ D-Bus access, such as bluetooth or plugdev

bash

# Disable Bluetooth on hosts that do not require it
sudo systemctl stop bluetooth.service
sudo systemctl mask bluetooth.service

# Verify status
systemctl status bluetooth.service