CVE-2026-105460

Received Received - Intake

Out-of-Bounds Read in BlueZ btmon Bluetooth Monitor

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105460

EUVD

EUVD-2026-98739

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 6 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-105460 is an out-of-bounds read vulnerability in the BlueZ Bluetooth stack affecting the btmon diagnostic tool. It occurs when processing crafted HCI Return Link Keys events in btsnoop capture files. A large number of link keys can exceed the packet data size, causing btmon to read beyond its allocated buffer and crash.

Detection Guidance

To detect this vulnerability, monitor btmon crashes when processing btsnoop files. Check system logs for btmon segmentation faults or crashes after opening suspicious files. No direct network detection is possible as exploitation requires local access to a crafted file.

Impact Analysis

This vulnerability can cause a denial of service (DoS) for btmon when a user opens a maliciously crafted btsnoop file. It does not impact the bluetoothd daemon or broader Bluetooth functionality. The crash occurs due to a stack buffer out-of-bounds read.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it only causes a denial of service in the btmon tool without impacting Bluetooth functionality or data confidentiality. However, if btmon is used in systems handling sensitive data, a crash could disrupt monitoring or logging processes, potentially affecting audit trails or incident response.

Mitigation Strategies

Avoid opening untrusted btsnoop files with btmon. Update BlueZ to the latest version if a patch is available. Monitor for btmon crashes and restrict access to btmon for untrusted users.

Hi! I’m here to help you understand CVE-2026-105460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70