CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.

Red Hat ships BlueZ in Red Hat Enterprise Linux and related products. The issue is in btmon, a diagnostic tool for Bluetooth debugging, not in the bluetoothd daemon. Exploitation requires a user to open a crafted btsnoop file with btmon (or equivalent user action). Impact is limited to denial of service of btmon.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not open untrusted btsnoop capture files with btmon.