{"id":"CLSA-2026-1792508765","summary":"bluez: Fix of 5 CVEs","details":"- CVE-2026-19774: fix stack-based buffer overflow in A2DP remote stream endpoint\n  codec capability storage and validate cached capabilities on load\n- CVE-2026-75032: fix out-of-bounds read in AVRCP GetFolderItems response parsing\n  by bounding media item and folder names to the received packet length\n- CVE-2026-80185: fix type confusion crash in SDP XML record parsing by rejecting\n  nested attributes and mismatched sequence/alternate closing elements\n- CVE-2026-80186: fix stack-based buffer overflow when parsing the remote device\n  name from EIR data\n- CVE-2026-85218: fix stack-based buffer overflows in AVRCP ListPlayerAttributes\n  response handling by validating the PDU length and clamping the attribute count","modified":"2026-10-26T09:31:01.978901071Z","published":"2026-10-20T15:06:18Z","upstream":["CVE-2026-19774","CVE-2026-75032","CVE-2026-80185","CVE-2026-80186","CVE-2026-85218"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792508765.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19774"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75032"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80185"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80186"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85218"}],"affected":[{"package":{"name":"bluez","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/bluez?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792508765.json"}},{"package":{"name":"bluez-cups","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/bluez-cups?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792508765.json"}},{"package":{"name":"bluez-hid2hci","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/bluez-hid2hci?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792508765.json"}},{"package":{"name":"bluez-libs","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/bluez-libs?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792508765.json"}},{"package":{"name":"bluez-libs-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/bluez-libs-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792508765.json"}},{"package":{"name":"bluez-mesh","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/bluez-mesh?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792508765.json"}},{"package":{"name":"bluez-obexd","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/bluez-obexd?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792508765.json"}}],"schema_version":"1.9.0"}