CVE-2026-68339Bluetooth: btusb: validate Realtek vendor event length
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusb_recv_event_realtek() reads the event code at data[0] and the Realtek subevent code at data[2] before deciding whether to consume a vendor event as a coredump. For example, the two-byte event ff 00 contains a complete vendor-event header declaring zero parameters. The old classifier still reads a nonexistent third byte and can misclassify the event as a coredump if the adjacent byte is 0x34. Require the HCI event header and first parameter to be present before inspecting the Realtek subevent code. Short events continue through the normal HCI receive path, which owns their protocol validation.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 044014ce85a17c0b7fab8e5df0925792010c29b2 builds before 8de58bfa26e028f99271dde5a92107cd07f5e063; from 044014ce85a17c0b7fab8e5df0925792010c29b2 before 400267bab0f4076088e163e58cad2bb41c3cf5e7; 044014ce85a17c0b7fab8e5df0925792010c29b2 builds before 8881daaafadbe7fb2b7341d16a3949114409c90c; 044014ce85a17c0b7fab8e5df0925792010c29b2 builds before 24b0758193d70da47ef8b979153d2a181dbdf34e; from 044014ce85a17c0b7fab8e5df0925792010c29b2 before df541cd485ff80a5ddc579d99687bc7506df9851 | CNA record |
References
- https://git.kernel.org/stable/c/8de58bfa26e028f99271dde5a92107cd07f5e063
- https://git.kernel.org/stable/c/400267bab0f4076088e163e58cad2bb41c3cf5e7
- https://git.kernel.org/stable/c/8881daaafadbe7fb2b7341d16a3949114409c90c
- https://git.kernel.org/stable/c/24b0758193d70da47ef8b979153d2a181dbdf34e
- https://git.kernel.org/stable/c/df541cd485ff80a5ddc579d99687bc7506df9851
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.