Description
BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| arkq | bluez-alsa | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bluez-alsa | No fix yet | — |
| Debian 13 | bluez-alsa | No fix yet | — |
| Debian 12 | bluez-alsa | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | bluez-alsa | No fix yet | — |
| Ubuntu 26.04 LTS | bluez-alsa | No fix yet | — |
| Ubuntu 24.04 LTS | bluez-alsa | No fix yet | — |
| Ubuntu 22.04 LTS | bluez-alsa | No fix yet | — |
References
- Patch Commit patch
- https://www.vulncheck.com/advisories/bluealsa-bluealsad-lc3plus-decoder-division-by-zero-dos third-party-advisory