CVE-2026-68479 (GCVE-0-2026-68479)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39
VLAI
Title
Bluetooth: btrtl: validate firmware patch bounds
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow and turn the copy into an oversized read and write during Bluetooth setup. The existing patch_offset + patch_length check can also wrap on 32-bit architectures. Validate the patch length and range without arithmetic overflow before allocating or copying the patch.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 , < 39e01b4addfbbe177567d6ed1dfb81f9cccb19e6 (git)
Affected: db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 , < bda3c598ade6ea03884074b91e31608326684921 (git)
Affected: db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 , < a4cb830e0b55ac76c849fd7840afb251f4c028fa (git)
Affected: db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 , < 68c5a2a19987c035eb129e627e579adafb04f637 (git)
Affected: db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 , < 83534891c058ed71e251135072640911670869aa (git)
Affected: db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 , < 6744ab60dfac55d1df5733960aad5be300984301 (git)
Affected: db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 , < f1ca750c0510bdbb504bf084d2f196ef2af92ea6 (git)
Affected: db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 , < 609c5b04a28dc1b0f3af6a7bc93055135b2d2059 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btrtl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "39e01b4addfbbe177567d6ed1dfb81f9cccb19e6",
              "status": "affected",
              "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
              "versionType": "git"
            },
            {
              "lessThan": "bda3c598ade6ea03884074b91e31608326684921",
              "status": "affected",
              "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
              "versionType": "git"
            },
            {
              "lessThan": "a4cb830e0b55ac76c849fd7840afb251f4c028fa",
              "status": "affected",
              "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
              "versionType": "git"
            },
            {
              "lessThan": "68c5a2a19987c035eb129e627e579adafb04f637",
              "status": "affected",
              "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
              "versionType": "git"
            },
            {
              "lessThan": "83534891c058ed71e251135072640911670869aa",
              "status": "affected",
              "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
              "versionType": "git"
            },
            {
              "lessThan": "6744ab60dfac55d1df5733960aad5be300984301",
              "status": "affected",
              "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
              "versionType": "git"
            },
            {
              "lessThan": "f1ca750c0510bdbb504bf084d2f196ef2af92ea6",
              "status": "affected",
              "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
              "versionType": "git"
            },
            {
              "lessThan": "609c5b04a28dc1b0f3af6a7bc93055135b2d2059",
              "status": "affected",
              "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btrtl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: validate firmware patch bounds\n\nrtlbt_parse_firmware() copies patch_length - 4 bytes before appending the\nfirmware version. A malformed firmware patch shorter than the version field\ncan make this subtraction underflow and turn the copy into an oversized\nread and write during Bluetooth setup.\n\nThe existing patch_offset + patch_length check can also wrap on 32-bit\narchitectures. Validate the patch length and range without arithmetic\noverflow before allocating or copying the patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Malformed input is parsed from host firmware files via request_firmware() during Realtek Bluetooth hci_power_on/setup (btusb_setup_realtek or h5_btrtl_setup \u2192 btrtl_initialize \u2192 rtlbt_parse_firmware); no network or Bluetooth packet path reaches this parser.\nAC:L - Attacker fully controls EPATCH patch_length and patch_offset in a crafted firmware blob; unsigned underflow of patch_length-4 and 32-bit patch_offset+patch_length wrap reliably trigger oversized memcpy on the next adapter power-on without races or attacker-uncontrolled layout.\nPR:L - Firmware is loaded from /lib/firmware/rtl_bt/ or Android /vendor/firmware/ paths that on many embedded and phone builds are writable by non-root system or vendor accounts; no init-namespace administrator privileges are needed to position the malicious EPATCH image.\nUI:N - rtlbt_parse_firmware runs automatically from hci_dev_setup_sync during hci_power_on when Realtek Bluetooth is enabled at boot or by bluetoothd, requiring no victim interaction such as pairing, mounting, or accepting prompts.\nS:U - Heap corruption and out-of-bounds access occur entirely within kernel memory during local firmware parsing on the same host; this does not cross VM, container, or IOMMU security boundaries.\nC:H - patch_length-4 unsigned underflow turns memcpy into a massive out-of-bounds read past the kvmemdup firmware buffer, exposing adjacent kernel heap or vmalloc contents well beyond any bounded leak.\nI:H - The same undersized patch_length allocates a small kvmalloc buffer then memcpy writes a huge amount into kernel heap, yielding a controllable heap overflow and out-of-bounds write usable for privilege escalation.\nA:H - Heap overflow and out-of-range copies during Bluetooth setup commonly cause kernel oops or panic; even without full exploitation the bug produces immediate high availability impact on affected Realtek adapters."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:20.556Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/39e01b4addfbbe177567d6ed1dfb81f9cccb19e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/bda3c598ade6ea03884074b91e31608326684921"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4cb830e0b55ac76c849fd7840afb251f4c028fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/68c5a2a19987c035eb129e627e579adafb04f637"
        },
        {
          "url": "https://git.kernel.org/stable/c/83534891c058ed71e251135072640911670869aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/6744ab60dfac55d1df5733960aad5be300984301"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1ca750c0510bdbb504bf084d2f196ef2af92ea6"
        },
        {
          "url": "https://git.kernel.org/stable/c/609c5b04a28dc1b0f3af6a7bc93055135b2d2059"
        }
      ],
      "title": "Bluetooth: btrtl: validate firmware patch bounds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68479",
    "datePublished": "2026-08-15T05:51:34.106Z",
    "dateReserved": "2026-07-30T09:28:09.397Z",
    "dateUpdated": "2026-08-17T05:39:20.556Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68479",
      "date": "2026-09-21",
      "epss": "0.00169",
      "percentile": "0.06588"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/bluetooth/btrtl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "39e01b4addfbbe177567d6ed1dfb81f9cccb19e6",
                    "status": "affected",
                    "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bda3c598ade6ea03884074b91e31608326684921",
                    "status": "affected",
                    "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a4cb830e0b55ac76c849fd7840afb251f4c028fa",
                    "status": "affected",
                    "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "68c5a2a19987c035eb129e627e579adafb04f637",
                    "status": "affected",
                    "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "83534891c058ed71e251135072640911670869aa",
                    "status": "affected",
                    "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6744ab60dfac55d1df5733960aad5be300984301",
                    "status": "affected",
                    "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f1ca750c0510bdbb504bf084d2f196ef2af92ea6",
                    "status": "affected",
                    "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "609c5b04a28dc1b0f3af6a7bc93055135b2d2059",
                    "status": "affected",
                    "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/bluetooth/btrtl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.2"
                  },
                  {
                    "lessThan": "4.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: validate firmware patch bounds\n\nrtlbt_parse_firmware() copies patch_length - 4 bytes before appending the\nfirmware version. A malformed firmware patch shorter than the version field\ncan make this subtraction underflow and turn the copy into an oversized\nread and write during Bluetooth setup.\n\nThe existing patch_offset + patch_length check can also wrap on 32-bit\narchitectures. Validate the patch length and range without arithmetic\noverflow before allocating or copying the patch."
          }
        ],
        "id": "CVE-2026-68479",
        "lastModified": "2026-08-17T06:17:57.447",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:20:51.380",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/39e01b4addfbbe177567d6ed1dfb81f9cccb19e6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/609c5b04a28dc1b0f3af6a7bc93055135b2d2059"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6744ab60dfac55d1df5733960aad5be300984301"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/68c5a2a19987c035eb129e627e579adafb04f637"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/83534891c058ed71e251135072640911670869aa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a4cb830e0b55ac76c849fd7840afb251f4c028fa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bda3c598ade6ea03884074b91e31608326684921"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f1ca750c0510bdbb504bf084d2f196ef2af92ea6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T16:05:03+00:00",
      "cve": "CVE-2026-68479",
      "id": "CVE-2026-68479",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: btrtl: validate firmware patch bounds",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68479.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T02:12:23Z",
      "cve": "CVE-2026-68479",
      "id": "CVE-2026-68479",
      "initial_release_date": "2026-08-26T01:15:15Z",
      "product_status:known_affected": "265",
      "product_status:known_not_affected": "97",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68479",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68479.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.