A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.

A stack-based buffer overflow vulnerability has been identified in BlueZ, the Linux Bluetooth protocol stack. An attacker within Bluetooth radio range can exploit this flaw by sending a specially crafted Extended Inquiry Response (EIR) packet during Bluetooth device discovery. The vulnerability triggers a buffer overflow condition that can crash the bluetoothd service, resulting in a Denial of Service (DoS). Beyond DoS, the flaw may also allow for arbitrary code execution on the affected system. The attack requires no authentication and only proximity within Bluetooth range. This affects Linux systems running BlueZ during active Bluetooth discovery operations. The vulnerability has been acknowledged by Red Hat and tracked in their security advisory and Bugzilla systems. A GitHub security advisory has also been published by the BlueZ project maintainers.