CVE-2026-80186

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.

A flaw of IMPORTANT severity was found in BlueZ, the Linux Bluetooth protocol stack, as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10 and in Red Hat In-Vehicle OS. A stack-based buffer overflow exists in the name2utf8 function of bluetoothd: a remote attacker within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet while the target device performs Bluetooth discovery, overflowing a stack buffer. Successful exploitation can crash the bluetoothd service, causing a denial of service, and may allow arbitrary code execution. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream. The Red Hat and upstream severity assessments are aligned at CVSS 3.1 score 7.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), rated IMPORTANT. A fix for the affected streams is being pursued.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.