Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-80186: A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.
Fixed packages 17
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bluez | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-cups | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-cups-debuginfo | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-debuginfo | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-debugsource | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-deprecated | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-deprecated-debuginfo | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-hid2hci | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-hid2hci-debuginfo | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-libs | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-libs-debuginfo | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-libs-devel | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-libs-devel-debuginfo | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-mesh | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-mesh-debuginfo | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-obexd | 0:5.62-2.amzn2023.0.6 |
| Amazon Linux · 2023 | bluez-obexd-debuginfo | 0:5.62-2.amzn2023.0.6 |
Vulnerabilities 1
-
High 7.6
Bluez: stack overflow in name2utf8 causes dos and potential code execution
A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target devic…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-80186.html