{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68479", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.397Z", "datePublished": "2026-08-15T05:51:34.106Z", "dateUpdated": "2026-08-17T05:39:20.556Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:39:20.556Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: validate firmware patch bounds\n\nrtlbt_parse_firmware() copies patch_length - 4 bytes before appending the\nfirmware version. A malformed firmware patch shorter than the version field\ncan make this subtraction underflow and turn the copy into an oversized\nread and write during Bluetooth setup.\n\nThe existing patch_offset + patch_length check can also wrap on 32-bit\narchitectures. Validate the patch length and range without arithmetic\noverflow before allocating or copying the patch."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Malformed input is parsed from host firmware files via request_firmware() during Realtek Bluetooth hci_power_on/setup (btusb_setup_realtek or h5_btrtl_setup \u2192 btrtl_initialize \u2192 rtlbt_parse_firmware); no network or Bluetooth packet path reaches this parser.\nAC:L - Attacker fully controls EPATCH patch_length and patch_offset in a crafted firmware blob; unsigned underflow of patch_length-4 and 32-bit patch_offset+patch_length wrap reliably trigger oversized memcpy on the next adapter power-on without races or attacker-uncontrolled layout.\nPR:L - Firmware is loaded from /lib/firmware/rtl_bt/ or Android /vendor/firmware/ paths that on many embedded and phone builds are writable by non-root system or vendor accounts; no init-namespace administrator privileges are needed to position the malicious EPATCH image.\nUI:N - rtlbt_parse_firmware runs automatically from hci_dev_setup_sync during hci_power_on when Realtek Bluetooth is enabled at boot or by bluetoothd, requiring no victim interaction such as pairing, mounting, or accepting prompts.\nS:U - Heap corruption and out-of-bounds access occur entirely within kernel memory during local firmware parsing on the same host; this does not cross VM, container, or IOMMU security boundaries.\nC:H - patch_length-4 unsigned underflow turns memcpy into a massive out-of-bounds read past the kvmemdup firmware buffer, exposing adjacent kernel heap or vmalloc contents well beyond any bounded leak.\nI:H - The same undersized patch_length allocates a small kvmalloc buffer then memcpy writes a huge amount into kernel heap, yielding a controllable heap overflow and out-of-bounds write usable for privilege escalation.\nA:H - Heap overflow and out-of-range copies during Bluetooth setup commonly cause kernel oops or panic; even without full exploitation the bug produces immediate high availability impact on affected Realtek adapters."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btrtl.c"], "versions": [{"version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "lessThan": "39e01b4addfbbe177567d6ed1dfb81f9cccb19e6", "status": "affected", "versionType": "git"}, {"version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "lessThan": "bda3c598ade6ea03884074b91e31608326684921", "status": "affected", "versionType": "git"}, {"version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "lessThan": "a4cb830e0b55ac76c849fd7840afb251f4c028fa", "status": "affected", "versionType": "git"}, {"version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "lessThan": "68c5a2a19987c035eb129e627e579adafb04f637", "status": "affected", "versionType": "git"}, {"version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "lessThan": "83534891c058ed71e251135072640911670869aa", "status": "affected", "versionType": "git"}, {"version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "lessThan": "6744ab60dfac55d1df5733960aad5be300984301", "status": "affected", "versionType": "git"}, {"version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "lessThan": "f1ca750c0510bdbb504bf084d2f196ef2af92ea6", "status": "affected", "versionType": "git"}, {"version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "lessThan": "609c5b04a28dc1b0f3af6a7bc93055135b2d2059", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btrtl.c"], "versions": [{"version": "4.2", "status": "affected"}, {"version": "0", "lessThan": "4.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/39e01b4addfbbe177567d6ed1dfb81f9cccb19e6"}, {"url": "https://git.kernel.org/stable/c/bda3c598ade6ea03884074b91e31608326684921"}, {"url": "https://git.kernel.org/stable/c/a4cb830e0b55ac76c849fd7840afb251f4c028fa"}, {"url": "https://git.kernel.org/stable/c/68c5a2a19987c035eb129e627e579adafb04f637"}, {"url": "https://git.kernel.org/stable/c/83534891c058ed71e251135072640911670869aa"}, {"url": "https://git.kernel.org/stable/c/6744ab60dfac55d1df5733960aad5be300984301"}, {"url": "https://git.kernel.org/stable/c/f1ca750c0510bdbb504bf084d2f196ef2af92ea6"}, {"url": "https://git.kernel.org/stable/c/609c5b04a28dc1b0f3af6a7bc93055135b2d2059"}], "title": "Bluetooth: btrtl: validate firmware patch bounds", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bluetooth/btrtl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "39e01b4addfbbe177567d6ed1dfb81f9cccb19e6", "status": "affected", "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "versionType": "git"}, {"lessThan": "bda3c598ade6ea03884074b91e31608326684921", "status": "affected", "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "versionType": "git"}, {"lessThan": "a4cb830e0b55ac76c849fd7840afb251f4c028fa", "status": "affected", "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "versionType": "git"}, {"lessThan": "68c5a2a19987c035eb129e627e579adafb04f637", "status": "affected", "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "versionType": "git"}, {"lessThan": "83534891c058ed71e251135072640911670869aa", "status": "affected", "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "versionType": "git"}, {"lessThan": "6744ab60dfac55d1df5733960aad5be300984301", "status": "affected", "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "versionType": "git"}, {"lessThan": "f1ca750c0510bdbb504bf084d2f196ef2af92ea6", "status": "affected", "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "versionType": "git"}, {"lessThan": "609c5b04a28dc1b0f3af6a7bc93055135b2d2059", "status": "affected", "version": "db33c77dddc2ed2cff3061d0b096a9f5ab0c3647", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bluetooth/btrtl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"lessThan": "4.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: validate firmware patch bounds\n\nrtlbt_parse_firmware() copies patch_length - 4 bytes before appending the\nfirmware version. A malformed firmware patch shorter than the version field\ncan make this subtraction underflow and turn the copy into an oversized\nread and write during Bluetooth setup.\n\nThe existing patch_offset + patch_length check can also wrap on 32-bit\narchitectures. Validate the patch length and range without arithmetic\noverflow before allocating or copying the patch."}], "id": "CVE-2026-68479", "lastModified": "2026-08-17T06:17:57.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:20:51.380", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/39e01b4addfbbe177567d6ed1dfb81f9cccb19e6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/609c5b04a28dc1b0f3af6a7bc93055135b2d2059"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6744ab60dfac55d1df5733960aad5be300984301"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/68c5a2a19987c035eb129e627e579adafb04f637"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/83534891c058ed71e251135072640911670869aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a4cb830e0b55ac76c849fd7840afb251f4c028fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bda3c598ade6ea03884074b91e31608326684921"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1ca750c0510bdbb504bf084d2f196ef2af92ea6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: btrtl: validate firmware patch bounds", "id": "2516350", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516350"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in the Linux kernel's Bluetooth btrtl module. This vulnerability allows a local attacker to provide a specially crafted firmware patch during Bluetooth setup. This can cause an integer underflow, leading to an oversized read and write operation. Such an operation can result in memory corruption, potentially enabling a denial of service or arbitrary code execution."], "name": "CVE-2026-68479", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68479\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68479\nhttps://lore.kernel.org/linux-cve-announce/2026081506-CVE-2026-68479-5ea9@gregkh/T"], "threat_severity": "Moderate"}