Executive brief
BlueZ is a Bluetooth protocol stack used by Linux systems to manage Bluetooth devices and connections. A type confusion vulnerability in the SDP XML parser allows a local attacker or adjacent Bluetooth peer to crash the bluetoothd daemon by sending a crafted ServiceRecord, causing a denial of service and interrupting Bluetooth functionality.
Technical details
A type confusion vulnerability (CWE-843) exists in BlueZ's sdp-xml.c file within the RegisterProfile() method handling. A crafted nested ServiceRecord can corrupt the SDP XML parser stack, causing scalar union data to be incorrectly treated as a sequence pointer. The vulnerability is triggered via a local caller or an adjacent Bluetooth network peer with low privileges and requires no user interaction. Exploitation results in a crash of the bluetoothd daemon (local DoS), and the parser's stack corruption could potentially allow memory read/write operations or code execution in certain configurations. Patches are available in updated BlueZ releases.
Affected products
- BlueZ BlueZ 5.86 and possibly earlier
Timeline
- 2026-08-25: disclosed