CVE-2026-80186 in Red Hat
Summary
by MITRE • 08/26/2026
A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The Linux operating system relies on BlueZ as its official Bluetooth protocol stack, managing everything from low-level hardware initialization to high-level profile implementations such as audio streaming or file transfer. Within this architecture, the bluetoothd daemon serves as a central process responsible for handling device discovery and connection management. During the standard Bluetooth inquiry procedure, devices exchange Extended Inquiry Response packets containing information about their capabilities and services. A critical flaw exists in how BlueZ processes these specific EIR packets when performing local device discovery operations. The vulnerability stems from insufficient bounds checking during the parsing of incoming data structures, allowing a remote attacker positioned within radio range to inject malformed input that exceeds the allocated stack memory limits.
This technical defect constitutes a classic stack-based buffer overflow condition where user-controlled data overwrites adjacent memory locations on the call stack. When an affected device attempts to discover nearby Bluetooth peripherals and receives the specially crafted EIR packet, the excessive data corrupts critical control information such as return addresses or saved frame pointers. This corruption disrupts normal program execution flow within the bluetoothd service process. The immediate operational impact is often a segmentation fault resulting in the termination of the daemon, which effectively causes a Denial of Service by disabling all Bluetooth functionality on the target system until the service is manually restarted or the device is rebooted.
Beyond simple availability disruption, this memory corruption presents severe security implications regarding integrity and confidentiality. If an attacker can precisely control the overflow payload, they may achieve arbitrary code execution with the privileges granted to the bluetoothd process. Depending on the specific Linux distribution configuration and privilege separation mechanisms in place, this could allow a local user or remote actor to escalate privileges, install malware, or pivot further into the network infrastructure. The attack vector is classified as remote because it requires only proximity within Bluetooth radio range rather than direct network access or authentication credentials, making it particularly dangerous for mobile devices like laptops and smartphones that frequently engage in discovery modes.
From a classification perspective, this vulnerability aligns with CWE-121 Stack-based Buffer Overflow, which describes the condition where data is written beyond the buffer boundary on the stack due to inadequate validation of input length. In terms of tactical behavior within adversary frameworks, this scenario maps closely to ATT&CK technique T1059 Command and Scripting Interpreter if code execution leads to shell access, or more broadly under initial exploitation vectors that target system services running with elevated privileges. The lack of proper boundary checks during the parsing of external inputs represents a fundamental failure in secure coding practices regarding memory management safety.
Mitigation strategies primarily involve applying vendor-provided security patches that update BlueZ to versions where input validation and buffer size limits are strictly enforced before processing EIR packets. System administrators should ensure automatic updates are enabled for Bluetooth stack components on all Linux-based endpoints, particularly those exposed to untrusted physical environments such as public spaces or corporate lobbies with open wireless access points. Additionally, disabling unnecessary Bluetooth discovery features when not in use can reduce the attack surface by preventing the system from actively processing incoming inquiry responses that trigger this flaw. Organizations should also monitor for unusual crashes of bluetoothd processes which may indicate an ongoing exploitation attempt and implement network segmentation to limit lateral movement if a compromise occurs.