CVE-2026-105460

Executive Summary

CVE-2026-105460 is an out-of-bounds read vulnerability (CWE-125) in BlueZ's btmon Bluetooth monitor tool, triggered when processing a crafted HCI Return Link Keys event within a malicious btsnoop capture file. An attacker who can convince a user to open a specially crafted capture file causes btmon to read beyond its allocated buffer, resulting in a crash (availability impact). The vulnerability is local, requires user interaction to load the file, and carries a CVSS 3.1 base score of 5.5 (Medium), with no public proof-of-concept, no Nuclei template, and no evidence of exploitation in the wild.

Technical Analysis

btmon is the BlueZ userspace utility used to decode and display Bluetooth HCI traffic, commonly sourced from btsnoop capture files. The flaw resides in the parsing routine that handles the HCI Return Link Keys event. This event carries a list of Bluetooth link keys, and the on-wire structure includes a count field that declares how many link keys follow. The parser trusts this attacker-controlled count without adequately validating it against the actual remaining bytes in the packet buffer. When the declared link key count is larger than the data actually present, btmon iterates past the end of the allocated buffer while decoding each entry, producing an out-of-bounds read.

The vulnerability is classified as CWE-125 (Out-of-bounds Read). The specific code path, function name, and internal validation logic are not disclosed in the available NVD description, so the exact implementation detail of the bounds check (or its absence) cannot be stated with certainty. What can be derived from the description is the mechanism: an attacker-supplied length/count field from a structured binary capture is consumed as a loop bound or offset calculation without a corresponding check against the buffer's actual size.

The attack surface is the file-import path of a diagnostic utility rather than a network-exposed service. Because btsnoop captures are frequently exchanged between engineers, QA teams, and bug reporters, an attacker can deliver the trigger as an innocuous-looking .btsnoop or capture attachment. The CVSS vector confirms a purely local, user-interaction-dependent trigger with Confidentiality and Integrity impacts rated None and Availability rated High, consistent with a crash rather than memory disclosure or code execution.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / Target Identification. The attacker identifies a target environment where btmon is installed and where capture files are routinely reviewed — for example, a Bluetooth protocol development team, an embedded/firmware QA group, or a security analyst reviewing Bluetooth traffic. No network scanning is required; the attacker only needs to know the victim uses BlueZ tooling.

2. Crafting the Trigger. The attacker constructs a btsnoop capture file containing an HCI Return Link Keys event whose embedded link key count field is set to a value larger than the amount of link key data actually present in the packet. This is a malformed-input exercise against a structured binary format; no specific parser internals, function names, or offsets are disclosed in the available data.

3. Delivery / Payload Execution. The malformed capture is delivered to the victim (email attachment, shared repository, issue tracker, or chat) and opened with btmon. Loading the file causes the parser to process the under-length packet and read beyond the allocated buffer, triggering the crash specified in the NVD description.

4. Post-Exploitation Impact. Based on the CVSS subscores, the direct effect is a denial of service against the btmon process (Availability: High). The scoring assesses Confidentiality and Integrity impact as None, so the described impact is a crash / availability loss, not data exfiltration or code execution. No privilege escalation or lateral movement is described.

Impact Assessment

The vulnerability is confined to the host running btmon and only manifests when a crafted capture file is opened (UI:R). The blast radius is therefore narrow: it affects analysis workstations, developer laptops, and CI or lab machines that parse untrusted Bluetooth captures. Because btmon is a diagnostic/analysis tool rather than a service, there is no remote unauthenticated exposure and no broad network explosion vector. The CVSS 3.1 subscores reflect this: AV:L (local), AC:L (low complexity), PR:N (no privileges required), UI:R (user must open the file), S:U (scope unchanged), C:N / I:N / A:H (availability-only impact). The practical business impact is loss of availability of the capture-analysis workflow and potential loss of unsaved analysis state when the tool crashes; it is a reliability/robustness defect in a parser handling untrusted input.

Detection Guidance

Sigma Rule

title: BlueZ btmon Crash from Malformed HCI Return Link Keys Capture
id: 8f3c1a2e-1054-4600-9b7e-0c2d5a6f7b91
status: experimental
description: Detects btmon process crashes consistent with out-of-bounds read on crafted btsnoop capture files
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105460
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/btmon'
    CommandLine|contains:
      - '-r'
      - '--read'
  selection_file:
    CommandLine|contains:
      - '.btsnoop'
      - '.log'
  condition: selection_proc and selection_file
fields:
  - CommandLine
  - Image
  - ParentImage
falsepositives:
  - Legitimate analysts opening trusted Bluetooth capture files
level: low

YARA Rule

rule CVE_2026_105460_btmon_HCI_Return_Link_Keys
{
    meta:
        description = "Detects crafted btsnoop captures with HCI Return Link Keys events (CVE-2026-105460)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105460"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $btsnoop_magic = { 62 74 73 6e 6f 6f 70 00 }  // "btsnoop\0"
        $hci_return_link_keys = { 04 13 }              // HCI event code 0x13 Return Link Keys

    condition:
        $btsnoop_magic at 0 and $hci_return_link_keys
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-105460 BlueZ btmon crafted HCI Return Link Keys capture transfer"; flow:to_client; content:"btsnoop"; content:"|04 13|"; distance:0; classtype:attempted-dos; reference:cve,2026-105460; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105460; sid:2026105460; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name == "btmon" and
  process.command_line like~ ("*-r*", "*--read*") and
  process.command_line like~ ("*.btsnoop*", "*.log*")

Splunk SPL Query

index=endpoint sourcetype=linux:audit OR sourcetype=sysmon_linux
| search process_name="btmon" AND (process="*btmon*" AND (CommandLine="*-r*" OR CommandLine="*--read*"))
| stats count min(_time) as first_seen by host, user, CommandLine
| where count > 0

Wazuh OSSEC Rule

<group name="bluetooth,bluez,">
  <rule id="105460" level="6">
    <decoded_as>json</decoded_as>
    <field name="process.name">btmon</field>
    <regex field="process.command_line">.*btmon.*(-r|--read).*(\.btsnoop|\.log).*</regex>
    <description>CVE-2026-105460: btmon invoked to parse untrusted Bluetooth capture file</description>
    <mitre>
      <id>T1204</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations. Treat btsnoop capture files as untrusted input. Do not open capture files from unknown or unverified sources with btmon. Where possible, sandbox btmon execution (container, restricted user, filesystem/namespace isolation) so a crash cannot affect other workloads. Apply anti-malware/attachment controls to filter or quarantine unexpected .btsnoop/capture attachments delivered by email or chat.

2. Patch / Upgrade Steps. No vendor fix is currently available per tracked sources. Monitor the BlueZ project and the distribution vendor (CVE-2026-105460) for an official advisory and patched package. Once a fix is published, update bluez/btmon packages through the distribution package manager and re-validate capture-parsing workflows. Because no patch exists, do not represent any version as fixed.

3. Long-Term Hardening. Adopt parsing hardening for diagnostic tooling: validate all attacker-controlled length and count fields against actual buffer bounds in any file-format decoder. Fuzz btsnoop/capture parsers (libFuzzer, AFL) as part of CI to catch CWE-125 regressions. Enforce least privilege for analyst workstations that handle third-party captures, and maintain an inventory of hosts running BlueZ development tooling for faster rollout when a patch is released.

References

• NVD — CVE-2026-105460: https://nvd.nist.gov/vuln/detail/CVE-2026-105460
• MITRE CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• BlueZ project (upstream, monitor btmon utility): http://www.bluez.org/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-105460 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (CVE-2026-105460 not yet scored): https://www.first.org/epss/

No public proof-of-concept, exploit code, Nuclei template, or in-the-wild exploitation evidence was identified for CVE-2026-105460 in the tracked sources. No threat actor campaign has been associated with this CVE.