CVE-2026-85218: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-85218 is a double stack-based buffer overflow vulnerability in the BlueZ AVRCP controller implementation, specifically in profiles/audio/avrcp.c. A nearby BR/EDR Bluetooth peripheral can send a crafted AVRCP player-settings response with an attacker-controlled attribute count, causing avrcp_list_player_attributes_rsp() and avrcp_get_current_player_value() to write past fixed-size stack buffers, potentially resulting in a crash or code execution in the root-owned bluetoothd daemon. The affected version is BlueZ v5.87, and the vulnerability was disclosed on September 3, 2026, by Alexandro Calò of Nozomi Networks Labs (advisory NN-2026-0145). It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 7.3 (High) (Red Hat CVE, BlueZ Advisory).

The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) and stems from insufficient bounds checking in the AVRCP player-settings response handler. In avrcp_list_player_attributes_rsp(), the code trusts pdu->params[0] as the attacker-controlled attribute count (up to 255) and iterates, writing accepted attribute IDs into a fixed 4-byte stack array attrs[AVRCP_ATTRIBUTE_LAST] (where AVRCP_ATTRIBUTE_LAST == 4), overflowing by up to 251 bytes. The inflated count is then passed to avrcp_get_current_player_value(), which performs a memcpy of up to 255 bytes into a 12-byte stack buffer (buf[AVRCP_HEADER_LENGTH + AVRCP_ATTRIBUTE_LAST + 1]), causing a second overflow of up to 243 bytes — both the overflow size and written bytes are attacker-controlled. Exploitation requires the victim device to reach the player-settings discovery phase of an AVRCP session with the malicious peripheral, and user interaction is required. A PoC is available on request from the reporter (BlueZ Advisory, Red Hat Bugzilla).

Successful exploitation can corrupt adjacent stack memory in the root-owned bluetoothd daemon, potentially enabling arbitrary code execution with root privileges or causing a daemon crash (denial of service). Because bluetoothd runs as root, a successful code execution exploit could grant the attacker full control over the affected system, with high impact to confidentiality, integrity, and availability. The scope is limited to the vulnerable system itself (no lateral movement to subsequent systems is indicated), but the root-level daemon context makes this a severe local privilege escalation risk for any system within Bluetooth range (BlueZ Advisory, Red Hat CVE).

The CVE status is currently "Reserved" and no in-the-wild exploitation has been reported as of the disclosure date. A PoC is available on request from Nozomi Networks Labs, and an AddressSanitizer report confirming the stack-buffer-overflow has been published in the GitHub Security Advisory. The attack requires the attacker to be physically adjacent (Bluetooth range), the victim to initiate or accept a BR/EDR connection with the malicious peripheral, and the session to reach the AVRCP player-settings discovery phase. No EPSS score or CISA KEV catalog entry is currently available for this CVE (BlueZ Advisory, Red Hat Bugzilla).

1. Setup malicious peripheral: Configure a BR/EDR Bluetooth device (e.g., a Linux system with a Bluetooth adapter) to act as a rogue AVRCP target, capable of sending crafted AVRCP responses.
2. Proximity and pairing: Position the attacker device within Bluetooth range of the victim running BlueZ v5.87. Induce or wait for the victim to connect to the rogue peripheral (e.g., via a spoofed device name or social engineering).
3. Trigger AVRCP session: Allow the AVRCP controller on the victim's bluetoothd to initiate player-settings discovery, which sends a ListPlayerAttributes request to the rogue peripheral.
4. Send crafted response: Respond with a malformed AVRCP player-settings PDU where pdu->params[0] is set to 255 (maximum attribute count) and the payload contains 255 valid-looking attribute bytes, triggering the first overflow in avrcp_list_player_attributes_rsp() past the 4-byte attrs[] stack array.
5. Trigger second overflow: The inflated count (255) is passed to avrcp_get_current_player_value(), which performs a memcpy of 255 bytes into a 12-byte stack buffer, overwriting 243 bytes of adjacent stack memory with attacker-controlled data.
6. Achieve code execution or crash: Craft the overflow payload to overwrite the return address or function pointers on the stack to redirect execution, or simply crash the bluetoothd daemon for denial of service (BlueZ Advisory, Red Hat Bugzilla).

• Process: Unexpected crash or restart of the bluetoothd daemon; core dumps from bluetoothd in /var/lib/systemd/coredump/ or /tmp/.
• Logs: System logs (/var/log/syslog, journalctl -u bluetooth) showing bluetoothd segmentation faults, AVRCP-related errors, or abnormal termination signals (SIGSEGV, SIGABRT) during Bluetooth audio device connection.
• Network/Bluetooth: Unexpected or unknown BR/EDR device appearing in Bluetooth scan results; repeated AVRCP ListPlayerAttributes response packets with anomalously large attribute counts (e.g., 255) captured via Bluetooth sniffers (e.g., Wireshark with btsnoop logs).
• File System: Presence of core dump files associated with bluetoothd; unexpected new processes spawned as root following a Bluetooth connection event (BlueZ Advisory).

The affected version is BlueZ v5.87; no patched version has been officially released as of the disclosure date (September 3, 2026), and the GitHub Security Advisory lists "None" under patched versions. Users should monitor the BlueZ GitHub repository and their Linux distribution's security advisories for patch availability. As interim mitigations, administrators should disable Bluetooth on systems where it is not required, restrict Bluetooth discoverability and pairing to trusted devices only, and avoid connecting to unknown or untrusted BR/EDR peripherals. Red Hat notes the affected version is v5.87 and advises following upstream for fixes (Red Hat CVE, BlueZ Advisory).

The vulnerability was reported by Alexandro Calò of Nozomi Networks Labs under advisory NN-2026-0145 and published via the BlueZ GitHub Security Advisory program. Red Hat has acknowledged the issue and opened a Bugzilla tracking entry, noting the CVSS score is preliminary and subject to review. No significant broader media coverage or social media discussion has been identified as of the disclosure date (BlueZ Advisory, Red Hat Bugzilla).