CVE-2026-80185: Access of Resource Using Incompatible Type ('Type Confusion') in Red Hat Red Hat Enterprise Linux 10

This vulnerability arises from a type confusion bug in BlueZ's sdp-xml.c via the RegisterProfile(ServiceRecord) function. A crafted nested ServiceRecord can corrupt the SDP XML parser stack by treating scalar union data as a sequence pointer, leading to a crash of the bluetoothd daemon. The issue is local or adjacent network exploitable with low privileges and no user interaction. The CVSS v3.1 score assigned by Red Hat is 5.7 (medium severity) with an availability impact classified as high. The vulnerability does not affect confidentiality or integrity. No official patch or remediation level is currently provided by Red Hat, and the affected versions are not explicitly stated. The vendor advisory notes that the vulnerability is under investigation and that fixes may be released in the future. No known exploits in the wild have been reported.

The vulnerability allows a local or adjacent attacker with low privileges to cause a denial of service by crashing the bluetoothd daemon on affected Red Hat Enterprise Linux 10 systems. There is no impact on confidentiality or integrity. No known exploitation in the wild has been reported. The availability impact is high due to the potential service disruption.

No official fix or patch is currently available according to the Red Hat advisory. The vulnerability is under investigation, and a fix may be released in the future. Users should monitor the Red Hat advisory for updates. No specific mitigations are provided by the vendor at this time. Applying mitigations or upgrading to a fixed version, once available, is recommended. Until then, limiting access to Bluetooth services or disabling bluetoothd where feasible may reduce exposure.