CVE-2026-68339
Received Received - Intake

Bluetooth: btusb Realtek Vendor Event Length Validation Flaw

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusb_recv_event_realtek() reads the event code at data[0] and the Realtek subevent code at data[2] before deciding whether to consume a vendor event as a coredump. For example, the two-byte event ff 00 contains a complete vendor-event header declaring zero parameters. The old classifier still reads a nonexistent third byte and can misclassify the event as a coredump if the adjacent byte is 0x34. Require the HCI event header and first parameter to be present before inspecting the Realtek subevent code. Short events continue through the normal HCI receive path, which owns their protocol validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68339
EUVD
EUVD-2026-55440

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of Bluetooth vendor events in the btusb driver. The issue occurs in btusb_recv_event_realtek() where the code reads event codes before checking if the event has sufficient length. This can lead to misclassification of short vendor events as coredumps if adjacent memory contains specific values.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and requires kernel-level inspection. Detection involves checking kernel logs for Bluetooth-related errors or examining the kernel version for affected Realtek Bluetooth firmware handling. Commands like dmesg | grep -i bluetooth or journalctl -k | grep -i bluetooth may help identify issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could allow an attacker to trigger unintended behavior in the Bluetooth subsystem by sending malformed vendor events. This might cause system instability, crashes, or unexpected coredump handling in the kernel.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for CVE-2026-68339. Disable Bluetooth if not in use or restrict its use to trusted devices. Monitor kernel logs for Bluetooth-related errors post-update to confirm mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68339. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart