CVE-2026-68479

Received Received - Intake

Bluetooth Firmware Patch Validation Flaw in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow and turn the copy into an oversized read and write during Bluetooth setup. The existing patch_offset + patch_length check can also wrap on 32-bit architectures. Validate the patch length and range without arithmetic overflow before allocating or copying the patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-08-15

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68479

EUVD

EUVD-2026-59101

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of Bluetooth firmware patches. The function rtlbt_parse_firmware() copies data before checking the patch length, which can lead to an underflow if the patch is too short. This causes an oversized read and write during Bluetooth setup, potentially corrupting memory or enabling arbitrary code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth Realtek module (btrtl). Detection requires checking kernel logs for Bluetooth-related errors during firmware loading. Monitor dmesg or journalctl for messages about Bluetooth firmware parsing failures or oversized reads. No direct network detection commands are applicable.

Impact Analysis

If exploited, this flaw could allow an attacker to execute arbitrary code or cause a denial of service on systems using affected Linux kernel versions. It specifically targets Bluetooth functionality during setup, which may lead to system instability or unauthorized access if the kernel is vulnerable.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Bluetooth firmware parsing issue in the Linux kernel. Compliance impacts would only occur if the vulnerability were exploited to gain unauthorized access to personal or health data during Bluetooth operations.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If immediate patching is not possible, disable Bluetooth functionality temporarily until the update is applied. Monitor vendor advisories for firmware updates for affected Bluetooth hardware.

Hi! I’m here to help you understand CVE-2026-68479. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...