CVE-2026-105460
5.5MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on availability
- Weakness
- CWE-125
Impact
Attackers can crash btmon by tricking a user into opening a maliciously crafted btsnoop capture file. They need local file access or user interaction to get the victim to inspect the malicious trace.
Root cause
The btmon tool does not validate the link key count in HCI Return Link Keys events against actual packet size, causing an out-of-bounds read and crash.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade BlueZ once your distribution releases a patched package. As an interim workaround, do not open untrusted btsnoop capture files with btmon.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.