CVE-2026-80186: 
Wolfi vulnerability analysis and mitigation

CVE-2026-80186 is a stack-based buffer overflow vulnerability in BlueZ, the Linux Bluetooth protocol stack, specifically in the name2utf8 function within src/eir.c. A remote, unauthenticated attacker within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet during Bluetooth device discovery to trigger the overflow, potentially causing a Denial of Service (DoS) or arbitrary code execution. The vulnerability affects BlueZ version 5.86 and was publicly disclosed on August 25, 2026. It carries a CVSS v3.1 base score of 7.6 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is a classic buffer overflow (CWE-120 / CWE-121 Stack-based Buffer Overflow) in the name2utf8 function in src/eir.c. The function allocates a 250-byte stack buffer (HCI_MAX_NAME_LENGTH = 248 + 2) and uses strncpy to copy the device name from an EIR packet without adequately validating the input length. An attacker crafts an EIR packet with a name field field_len of 254, causing data_len passed to name2utf8 to be 253 — exceeding the 250-byte buffer by 3 bytes and corrupting adjacent stack frame data including potentially the saved return address. A self-contained proof-of-concept (PoC) C program demonstrating the overflow using AddressSanitizer has been published in the official BlueZ security advisory (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes at minimum a reliable crash of the bluetoothd service (DoS), disrupting all Bluetooth functionality on the affected device. On systems without stack canaries or with predictable canary values, the 3-byte overflow of the return address enables potential remote code execution (RCE) in the context of the bluetoothd process, with low confidentiality and integrity impact alongside high availability impact. The attack requires no authentication and no user interaction, making it exploitable by any attacker within Bluetooth radio range (GitHub Advisory, Red Hat Advisory).

A public PoC demonstrating the stack buffer overflow was included in the official BlueZ GitHub security advisory at the time of disclosure on August 25, 2026 (GitHub Advisory). The EPSS score is currently 0.0, indicating low observed exploitation probability at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No in-the-wild exploitation or threat actor attribution has been reported as of the disclosure date (Feedly).

1. Reconnaissance: Identify target devices running BlueZ 5.86 with Bluetooth discovery enabled, using tools such as hcitool scan or bluetoothctl from within Bluetooth radio range (typically up to ~10 meters for Class 2 devices).
2. Craft malicious EIR packet: Construct a raw Bluetooth EIR packet containing a device name field with field_len set to 254, resulting in a 253-byte name payload that exceeds the 250-byte utf8_name stack buffer in name2utf8.
3. Trigger Bluetooth discovery on target: Ensure the target device is performing or can be induced to perform Bluetooth device discovery, which causes it to process incoming EIR packets from nearby devices.
4. Transmit malicious packet: Broadcast the crafted EIR packet using a Bluetooth adapter with raw HCI access (e.g., via hcitool or a custom HCI tool), so the target's bluetoothd processes the oversized name field.
5. Achieve DoS or RCE: The strncpy call in name2utf8 writes 253 bytes into the 250-byte buffer, overflowing by 3 bytes. On systems without stack canaries, this may overwrite the return address, enabling RCE; on hardened systems, it reliably crashes bluetoothd (GitHub Advisory).

• Process: Unexpected crash or restart of the bluetoothd daemon; core dump files generated by bluetoothd in /var/lib/systemd/coredump/ or /tmp/.
• Logs: System journal entries (journalctl -u bluetooth) showing bluetoothd segmentation faults or abnormal termination; repeated bluetoothd restarts in a short time window.
• Network/Bluetooth: Unusual Bluetooth inquiry activity from an unknown device address (BD_ADDR) in HCI logs; EIR packets with name field lengths of 254 captured via btmon or hcidump.
• File System: Presence of core dump files associated with bluetoothd process crashes (GitHub Advisory, Red Hat Advisory).

The vulnerability is patched in BlueZ at commit 381b5d0d208972586282116d333865ba93b8dec2; users should update to a patched version of BlueZ beyond 5.86 as soon as packages become available from their distribution (GitHub Advisory). As a workaround, disabling Bluetooth discovery mode (making the device non-discoverable) prevents the target from processing attacker-controlled EIR packets and mitigates the attack vector. Additionally, disabling the Bluetooth service entirely (systemctl stop bluetooth && systemctl disable bluetooth) eliminates exposure where Bluetooth functionality is not required (Red Hat Advisory).

The vulnerability was reported by researcher sprabhav7 and published by BlueZ maintainer hadess via the official BlueZ GitHub security advisory on August 25, 2026 (GitHub Advisory). Red Hat acknowledged the issue and opened a tracking bug, classifying it as high severity (Red Hat Bugzilla). Early social media coverage appeared on Mastodon via The Hacker Wire shortly after disclosure, and the CVE was picked up by automated vulnerability tracking services including VulDB and CVEFeed (Feedly).