CVE-2026-80186: Bluez: stack overflow in name2utf8 causes dos and potential code execution
A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.
Other sources
https://github.com/bluez/bluez/security/advisories/GHSA-68h6-5qgp-3975
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker only needs to be within Bluetooth radio range of a target using the affected BlueZ stack. No authentication, privileges, or user interaction are required.
When is a device exposed to the malicious packet?
The vulnerable code path is reached when the target performs Bluetooth discovery and processes a crafted Extended Inquiry Response packet.
What is the likely impact of a successful attack?
The attacker can crash the bluetoothd service, causing a denial of service. The buffer overflow may also permit arbitrary code execution.