CVE-2026-80185

BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.

A moderate impact type confusion flaw was found in BlueZ's SDP XML parser (sdp-xml.c). An unprivileged local user can call the org.bluez.ProfileManager1.RegisterProfile D-Bus method with a crafted ServiceRecord XML document containing a nested <attribute> element inside a <sequence>; this corrupts the parser's internal parse stack so that scalar union data (for example a uint64 value) is later treated as a dataseq linked-list pointer when sequence sizes are computed, causing the bluetoothd daemon, which runs as root, to crash. The available evidence establishes local denial of service only: while the upstream advisory title refers to arbitrary code execution as root by an unprivileged local user or an adjacent Bluetooth LE peer, neither the upstream analysis nor Red Hat's assessment demonstrates code execution, and Red Hat has rated this flaw Moderate severity with a CVSS 3.1 base score of 5.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting impact to availability only. The bluez package as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10, in Red Hat In-Vehicle OS, and in Fedora is affected, and fixes are being pursued for these products. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in the bluez version it ships.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Until a fix is available, restrict untrusted local access to the org.bluez.ProfileManager1.RegisterProfile D-Bus method, or more broadly to the org.bluez name on the system bus, for example via a D-Bus system bus policy or polkit rule, so that untrusted callers cannot submit arbitrary ServiceRecord XML. Disabling the Bluetooth service on systems where it is not required also reduces exposure.