CVE-2026-80186: BlueZ Bluetooth Stack RCE Vulnerability

CVE-2026-80186 Overview

CVE-2026-80186 is a stack-based buffer overflow in BlueZ, the official Linux Bluetooth protocol stack. An attacker within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet. When the target device performs Bluetooth discovery, parsing the malicious EIR overflows a stack buffer in the bluetoothd service.

Exploitation can crash bluetoothd and cause a denial of service. The advisory also indicates the flaw may enable arbitrary code execution in the context of the Bluetooth daemon. The vulnerability is tracked under CWE-120, classic buffer copy without checking size of input.

Critical Impact
A single crafted EIR packet from Bluetooth range can crash bluetoothd on affected Linux systems and may allow code execution in the Bluetooth daemon.

Affected Products

BlueZ, the Linux Bluetooth protocol stack (bluetoothd)
Linux distributions shipping vulnerable BlueZ builds, including Red Hat Enterprise Linux (per Red Hat CVE-2026-80186)
Devices performing Bluetooth discovery while a malicious peer is in radio range

Discovery Timeline

2026-08-25 - CVE-2026-80186 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-80186

Vulnerability Analysis

The flaw resides in BlueZ code that parses Extended Inquiry Response (EIR) data received during Bluetooth device discovery. EIR is a structured payload sent by remote Bluetooth devices in response to an inquiry, carrying fields such as device name, service UUIDs, and manufacturer data.

BlueZ copies EIR field contents into a fixed-size stack buffer without adequately validating the attacker-controlled length. A malformed length byte causes the copy to write past the buffer boundary, corrupting adjacent stack memory in bluetoothd.

Because the parsing occurs inside a long-running privileged service, corruption typically results in a crash of the Bluetooth daemon. Depending on stack layout and mitigations such as stack canaries and ASLR, controlled overwrite of saved return addresses or function pointers may permit arbitrary code execution.

Root Cause

The root cause is a missing or insufficient bounds check on an attacker-controlled length field when copying EIR structure data into a stack-allocated buffer. This maps to CWE-120, buffer copy without checking size of input, commonly known as a classic buffer overflow.

Attack Vector

The attack requires only Bluetooth radio proximity to the target and no authentication or user interaction. An attacker broadcasts or responds with a malicious EIR payload while the victim performs Bluetooth discovery. Parsing the crafted packet triggers the overflow inside bluetoothd. See the GitHub Security Advisory GHSA-68h6-5qgp-3975 for protocol-level details.

No public proof-of-concept exploit is currently listed for this CVE, and it is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-80186

Indicators of Compromise

Unexpected crashes, segmentation faults, or restarts of the bluetoothd process recorded in journalctl -u bluetooth or /var/log/syslog.
Core dumps generated for bluetoothd on systems where core dumps are enabled.
Repeated Bluetooth discovery failures or HCI adapter resets shortly after receiving inquiry responses from unknown devices.

Detection Strategies

Monitor systemd service state transitions for the bluetooth.service unit and alert on abnormal exit codes or restart loops.
Collect and inspect HCI traces (btmon, hcidump) in high-risk environments to identify malformed EIR structures with inconsistent length fields.
Correlate proximity-based anomalies, such as new unknown Bluetooth MAC addresses appearing immediately before bluetoothd failures.

Monitoring Recommendations

Forward Bluetooth subsystem logs and audit events to a centralized logging or SIEM platform for retention and correlation.
Baseline normal bluetoothd uptime and alert on deviations, particularly on servers, kiosks, and IoT gateways that rarely restart the service.
Track package inventory for the installed bluez version across the fleet and flag hosts running versions predating the vendor fix.

How to Mitigate CVE-2026-80186

Immediate Actions Required

Apply vendor-supplied BlueZ security updates as soon as they are available from your Linux distribution, referencing the Red Hat advisory and Red Hat Bug #2524132.
Disable Bluetooth on systems that do not require it, especially servers, virtualization hosts, and network appliances.
Restrict Bluetooth discovery to controlled environments and avoid initiating scans in untrusted physical locations.

Patch Information

Refer to the BlueZ GitHub Security Advisory GHSA-68h6-5qgp-3975 for the fixed upstream commits and version guidance. Distribution-specific package updates are tracked through vendor advisories, including the Red Hat CVE-2026-80186 page. Update the bluez package on all affected hosts and restart the bluetooth.service unit to load the patched daemon.

Workarounds

Stop and mask the Bluetooth service where not needed: systemctl stop bluetooth && systemctl mask bluetooth.
Blacklist Bluetooth kernel modules such as btusb and bluetooth in /etc/modprobe.d/ to prevent the stack from loading.
Avoid performing device discovery in public spaces until the patched bluez package is deployed.

bash

# Configuration example
# Disable and mask the Bluetooth daemon until patched packages are installed
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
sudo systemctl mask bluetooth.service

# Prevent the Bluetooth kernel modules from loading at boot
echo 'blacklist btusb'     | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist bluetooth' | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf

# Verify installed BlueZ version after patching
dpkg -s bluez 2>/dev/null | grep -E '^Version'   # Debian/Ubuntu
rpm -q bluez                                     # RHEL/Fedora