Executive brief
BlueZ is the standard Bluetooth protocol stack on Linux systems, handling wireless device discovery and pairing. A remote attacker within Bluetooth range can crash the bluetoothd service by sending a malformed discovery packet, causing temporary unavailability of Bluetooth connectivity. The vulnerability may also allow arbitrary code execution with the privileges of the bluetoothd service.
Technical details
A stack-based buffer overflow exists in BlueZ's Extended Inquiry Response (EIR) packet handling, specifically in the name2utf8 function. The vulnerability is triggered when a remote user within Bluetooth radio range sends a specially crafted EIR packet during device discovery, causing a buffer overflow on the target device. Attack requires no authentication or user interaction. An attacker can achieve Denial of Service by crashing the bluetoothd service and potentially arbitrary code execution with service-level privileges. Patches are available from the BlueZ project; Red Hat's CVSS assessment is 7.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).
Affected products
- BlueZ BlueZ <UNKNOWN>
Timeline
- 2026-08-25: disclosed