CVE-2026-101887
Description
BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.
How to fix
- arkq bluez-alsa1a84465dd860d1be9dcf62339c6273e9e0632dd2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arkq bluez-alsa | v < 1a84465dd860d1be9dcf62339c6273e9e0632dd2 | 1a84465dd860d1be9dcf62339c6273e9e0632dd2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.