A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.

An out-of-bounds read vulnerability exists in BlueZ btmon's returnlinkkeysevt() in monitor/packet.c. The function uses evt->numkeys from an HCI Return Link Keys event (0x15) as a loop bound without validating that (numkeys 22 + 1) <= size. Crafted btsnoop input (e.g. plen=3, numkeys=85) causes out-of-bounds reads and crashes btmon (stack buffer OOB read; reporter ASan trace). Affects btmon only, not bluetoothd.

Upstream: bluez <= 5.87 reported; upstream git master (checked 2026-10-05) still lacks bounds check in returnlinkkeysevt(). No upstream fix commit identified.

PSIRT ticket: PSIRTSUPT-24932 Reporter: zhailiangliang (Loongson Technology) Verification: docs/SDLC/VM/bluez/psirtsupt-24932/ (static Kaiden analysis)