BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-84b4f1c43a advisory.

    BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a     crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a     sequence pointer, allowing a local caller to crash bluetoothd.

    ----

    A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote     user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that     causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead     to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code     execution.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d4eec45564 advisory.

    BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a     crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a     sequence pointer, allowing a local caller to crash bluetoothd.

    ----

    A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote     user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that     causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead     to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code     execution.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1fba3f22c9 advisory.

    BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a     crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a     sequence pointer, allowing a local caller to crash bluetoothd.

    ----

    A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote     user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that     causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead     to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code     execution.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a     crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a     sequence pointer, allowing a local caller to crash bluetoothd. (CVE-2026-80185)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
344869	Fedora 45 : bluez (2026-84b4f1c43a)	Nessus	Fedora Local Security Checks	Local	high
341828	Fedora 43 : bluez (2026-d4eec45564)	Nessus	Fedora Local Security Checks	Local	high
341366	Fedora 44 : bluez (2026-1fba3f22c9)	Nessus	Fedora Local Security Checks	Local	high
339677	Linux Distros Unpatched Vulnerability : CVE-2026-80185	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-80185

medium

Tenable Plugins

high

high

high

medium