Bug 2545923 (CVE-2026-105460) - CVE-2026-105460 bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()
Summary: CVE-2026-105460 bluez: bluez: stack-based out-of-bounds read in btmon via unv...
Keywords:
Status: NEW
Alias: CVE-2026-105460
Deadline: 2026-10-21
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-05 14:32 UTC by OSIDB Bzimport
Modified: 2026-10-13 13:57 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-05 14:32:17 UTC 
An out-of-bounds read vulnerability exists in BlueZ btmon's return_link_keys_evt() in monitor/packet.c. The function uses evt->num_keys from an HCI Return Link Keys event (0x15) as a loop bound without validating that (num_keys * 22 + 1) <= size. Crafted btsnoop input (e.g. plen=3, num_keys=85) causes out-of-bounds reads and crashes btmon (stack buffer OOB read; reporter ASan trace). Affects btmon only, not bluetoothd.

Upstream: bluez <= 5.87 reported; upstream git master (checked 2026-10-05) still lacks bounds check in return_link_keys_evt(). No upstream fix commit identified.

PSIRT ticket: PSIRTSUPT-24932
Reporter: zhailiangliang (Loongson Technology)
Verification: docs/SDLC/VM/bluez/psirtsupt-24932/ (static Kaiden analysis)
Note You need to log in before you can comment on or make changes to this bug.