CVE-2026-80185 in Red Hat
Summary
by MITRE • 08/26/2026
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in BlueZ involves a critical type confusion flaw within the sdp-xml.c module, specifically triggered during the execution of the RegisterProfile function when processing ServiceRecord structures. This issue stems from an improper validation mechanism that fails to correctly distinguish between scalar union data and sequence pointers within nested XML-based service records. When a local attacker provides a crafted input containing deeply nested or malformed ServiceRecord elements, the parser incorrectly interprets specific scalar values as memory addresses pointing to sequences. This misinterpretation leads to a type confusion error where the application attempts to dereference what it believes is a pointer but is actually arbitrary data from the stack or heap.
From a technical perspective, this flaw represents a classic instance of improper input validation leading to memory corruption. The SDP XML parser relies on strict adherence to expected data types and structures defined in Bluetooth specifications. However, due to insufficient boundary checks and type assertions during the parsing process, the software allows an attacker to manipulate the internal state of the bluetoothd daemon. By forcing the parser to treat a scalar union field as a pointer, the application may attempt to access invalid memory locations or execute unintended control flow paths. This typically results in a segmentation fault or similar crash condition within the bluetoothd process, which is responsible for managing Bluetooth protocol stacks and device configurations on Linux-based systems.
The operational impact of this vulnerability is primarily a local denial-of-service attack against the Bluetooth subsystem. Since the exploit requires local access to trigger the malformed input via D-Bus interfaces exposed by BlueZ, it does not allow for remote code execution or privilege escalation directly through this vector alone. However, crashing bluetoothd disrupts all active Bluetooth connections and prevents new ones from being established until the service is restarted. In environments where Bluetooth connectivity is critical for peripheral operation, such as in enterprise settings with wireless keyboards, mice, or audio devices, this disruption can lead to significant productivity losses and operational downtime. Furthermore, if bluetoothd runs with elevated privileges, a crash could potentially be leveraged in conjunction with other vulnerabilities to achieve more severe outcomes, although the primary risk remains service availability.
This vulnerability aligns with CWE-843, which classifies access of incorrect type via pointer cast, as well as CWE-20 regarding improper input validation. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK technique T1562.001, specifically Impair Defenses: Disable or Modify Tools, by targeting system utilities that manage hardware interfaces. The attack vector is classified as local (AV:L) with low complexity and requires no user interaction beyond having access to the D-Bus interface, which typically necessitates a logged-in session on the target machine.
Mitigation strategies should focus on both immediate patching and long-term architectural improvements. Organizations running BlueZ must apply vendor-provided security updates that address this specific type confusion in sdp-xml.c. Until patches are available, restricting D-Bus access to trusted users can reduce the attack surface by preventing unprivileged local accounts from invoking RegisterProfile with arbitrary ServiceRecord data. Additionally, enabling core dumps and monitoring for frequent restarts of bluetoothd can aid in early detection of exploitation attempts. Future development efforts should prioritize implementing stricter type checking within the XML parser and adopting fuzzing techniques to identify similar parsing flaws before they reach production environments.