CVE-2026-24081

A buffer over-read (CWE-126) in the Bluetooth channel-map handling of Qualcomm chipsets causes a transient denial of service when a channel map containing an insufficient number of used channels is processed while adaptive frequency hopping (AFH) is fully enabled. An attacker in adjacent wireless range, requiring no privileges or user interaction, can trigger the flaw by sending a crafted channel map to the vulnerable Bluetooth component. The impact is availability-only (CVSS availability: high; confidentiality/integrity: none), meaning the affected device's Bluetooth functionality transiently fails, with no code execution or data compromise. Any device running the affected Qualcomm Bluetooth firmware is potentially exposed, although the provided data does not enumerate specific chipset models or versions. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and exploitation has not been observed.

What to do: Monitor Qualcomm's security bulletin for CVE-2026-24081 and apply device firmware/OS updates from your OEM for affected Qualcomm Bluetooth components as they are released. Until patched, disable Bluetooth when not needed in environments with nearby untrusted devices, since the attack vector is adjacent (Bluetooth range). Inventory hardware for Qualcomm-based Bluetooth chipsets now so affected devices can be prioritized once the affected product list is published.