The bug resides in the Bluetooth monitor daemon (btmon) of BlueZ. When it processes an HCI Return Link Keys event, the num_keys field is not validated, allowing an attacker to supply a count that is larger than the actual data present in the packet. This causes btmon to read past the end of the allocated buffer, resulting in an out‑of‑bounds read. The immediate consequence is a crash of the monitoring process, which can be used by an attacker to cause a denial of service. While the read is untrusted, the description does not indicate a direct information‑leak risk, but the buffer overflow could potentially expose memory contents if an attacker could observe the crash environment.

The flaw affects installations of Red Hat Enterprise Linux from version 6 through 10, as those releases ship the vulnerable BlueZ stack. Administrators who run the btmon tool on any of those operating system versions are potentially exposed.

The CVSS base score of 5.5 reflects moderate impact, and the EPSS score is not available, so the likelihood of widespread exploitation is uncertain. The vulnerability requires the attacker to provide a crafted btsnoop capture file and invoke btmon against it, which means the exploit is local to a user who can run the tool or to a compromised host that runs the monitoring process. Once the crafted packet is processed, btmon terminates, leading to a service disruption. Because the attack does not require network access or elevated privileges, it can be triggered by any user with the ability to run btmon.