CVE-2026-105460 — Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()
A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously craf…
Published: 2026-10-13 · CVSS: 5.5 · CVSS 3.1
A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7