Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A double stack-based buffer overflow was found in the BlueZ AVRCP controller implementation in profiles/audio/avrcp.c. When processing an AVRCP player settings response, avrcp_list_player_attributes_rsp() trusts an attacker-controlled attribute count from pdu->params[0] and writes past a 4-byte stack array (attrs[4]). The inflated count (up to 255) is then passed to avrcp_get_current_player_value(), which copies attacker-controlled data into a 12-byte stack buffer via memcpy, causing a second, larger overflow (up to ~243 bytes past the buffer). A malicious nearby BR/EDR Bluetooth peripheral can exploit this by sending a crafted AVRCP player-settings response once a victim device reaches player-settings discovery, corrupting adjacent stack memory in the root-owned bluetoothd daemon and potentially achieving code execution. Reported by Alexandro Calò of Nozomi Networks Labs (advisory NN-2026-0145). Reference: https://github.com/bluez/bluez/security/advisories/GHSA-m2vx-pw5f-rc8v
Patches are available at https://patchwork.kernel.org/project/bluetooth/list/?series=1155564 and will be included in a future upstream fix.
FEDORA-2026-9e011ac6ed (bluez-5.87+1.git8750129efca8-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-9e011ac6ed
FEDORA-2026-d4156b5fc5 (bluez-5.87+1.git8750129efca8-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-d4156b5fc5
FEDORA-2026-6ed52ea50e (bluez-5.87+1.git8750129efca8-1.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-6ed52ea50e
FEDORA-2026-d4156b5fc5 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-d4156b5fc5` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d4156b5fc5 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-6ed52ea50e has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-6ed52ea50e` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-6ed52ea50e See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-9e011ac6ed has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-9e011ac6ed` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-9e011ac6ed See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-d4156b5fc5 (bluez-5.87+1.git8750129efca8-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-9e011ac6ed (bluez-5.87+1.git8750129efca8-1.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-6ed52ea50e (bluez-5.87+1.git8750129efca8-1.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.