Control: tags -1 + fixed-upstream patch Hi,
Upstream issue https://www.google.com/url?q=https://github.com/bluez/bluez/issues/2687&source=gmail&ust=1793792770114000&sa=E is still open, but the fix landed on master on 2026-10-27: 6475b75e7e0e4f62b032e743df11a6f76836d564 "monitor: validate Return Link Keys length before parsing" https://www.google.com/url?q=https://github.com/bluez/bluez/commit/6475b75e7e0e4f62b032e743df11a6f76836d564&source=gmail&ust=1793792770115000&sa=E Fixes: 7d103ce15295 ("monitor: Add support for decoding the return link keys event") It adds one check in return_link_keys_evt() (monitor/packet.c): if size is less than 1 + num_keys*22, it prints "too short packet" and returns. The commit message describes the author's own ASan before/after testing. What I checked (static only): - The fix is not in any release; 5.87 is 418 commits behind it. - It applies to the 5.87 monitor/packet.c with patch -p1, with an offset of -576 lines and no fuzz. - None of the patches in debian/patches on salsa touch monitor/packet.c. I did not build btmon or run any reproducer. As upstream notes on the issue, this only affects btmon, a debugging tool, so it seems a candidate for the next upload rather than anything urgent. Regards
