BlueZ btmon EUVD-2026-98739

Exploitation requires a user to run the btmon Bluetooth monitor tool and open/process an attacker-supplied btsnoop capture file containing a crafted HCI Return Link Keys event that specifies more link keys than the packet actually holds. Limiting factors: access is local only (AV:L), mandatory user interaction is required (UI:R) since the victim must deliberately load the malicious file into btmon, and the tool is a diagnostic/debugging utility not typically exposed to untrusted input in normal operation. There is no network vector and no automated/unattended trigger, which sharply constrains real-world risk relative to the 5.5 base score.

This is a genuinely low-priority issue despite being a memory-safety flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) describes a local, user-interaction-dependent out-of-bounds read whose only impact is availability (A:H) - the btmon tool crashes. There is no confidentiality or integrity impact (C:N/I:N), so this is effectively a denial-of-service against a diagnostic utility, not a code-execution or data-leak vector. No EPSS score, KEV listing, or POC was provided in the input: exploitation status is 'no public exploit identified at time of analysis.' Note a tension between the CWE and the impact: CWE-125 out-of-bounds read often implies potential information disclosure, yet the vendor vector sets C:N, consistent with the description stating the result is a crash rather than a leak - treat any 'information disclosure' framing as unconfirmed. The realistic attack surface is narrow because btmon is an operator-run Bluetooth monitoring/debugging tool, not a network-facing or always-on service; a victim must deliberately process an attacker-supplied btsnoop file. Priority: low - routine patching, not emergency response.

An attacker crafts a malicious btsnoop capture file in which an HCI Return Link Keys event declares more link keys than the packet actually contains, then delivers it to a target (e.g., via email or a shared capture repository). When an analyst or administrator opens the file with btmon, the tool reads past the allocated buffer and crashes. No public exploit code was provided in the input, and the impact is limited to crashing the local diagnostic tool (A:H, C:N/I:N).