CVE-2026-105460: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10

This vulnerability in BlueZ's btmon tool arises from improper handling of HCI Return Link Keys events in btsnoop capture files. A crafted capture file specifying more link keys than the actual packet data causes an out-of-bounds read, leading to a crash of the btmon process. The flaw affects Red Hat Enterprise Linux 10. The CVSS 3.1 base score is 5.5, reflecting a local attack vector with low complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality or integrity impact, and high availability impact.

The vulnerability causes a denial of service by crashing the btmon tool when processing maliciously crafted btsnoop capture files. There is no impact on confidentiality or integrity. Exploitation requires local access and user interaction.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-105460 for current remediation guidance. Until a fix is applied, avoid processing untrusted btsnoop capture files with btmon.