CVE-2026-105460: Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()
A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.
Other sources
An out-of-bounds read vulnerability exists in BlueZ btmon's returnlinkkeysevt() in monitor/packet.c. The function uses evt->numkeys from an HCI Return Link Keys event (0x15) as a loop bound without validating that (numkeys 22 + 1) <= size. Crafted btsnoop input (e.g. plen=3, numkeys=85) causes out-of-bounds reads and crashes btmon (stack buffer OOB read; reporter ASan trace). Affects btmon only, not bluetoothd.
Upstream: bluez <= 5.87 reported; upstream git master (checked 2026-10-05) still lacks bounds check in returnlinkkeysevt(). No upstream fix commit identified.
PSIRT ticket: PSIRTSUPT-24932 Reporter: zhailiangliang (Loongson Technology) Verification: docs/SDLC/VM/bluez/psirtsupt-24932/ (static Kaiden analysis)
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems where someone runs btmon against an untrusted or attacker-supplied btsnoop capture file are exposed. The issue affects btmon only; bluetoothd is not affected.
What does an attacker need to do to trigger the crash?
An attacker needs to provide a crafted btsnoop capture containing an HCI Return Link Keys event with a num_keys value larger than the packet data supports. When btmon processes that event, it can read beyond its allocated buffer and crash.
Is there an upstream fix available?
No upstream fix commit was identified. Upstream git master, checked on 2026-10-05, still lacked the bounds check in return_link_keys_evt().
What can be done if patching is not immediately possible?
Do not process untrusted btsnoop capture files with btmon. Restrict access to capture files and only analyze captures from trusted sources until a bounds-checking fix is available.