CVE-2026-68339 (GCVE-0-2026-68339)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-08-17 05:03
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: validate Realtek vendor event length
btusb_recv_event_realtek() reads the event code at data[0] and the Realtek
subevent code at data[2] before deciding whether to consume a vendor event
as a coredump.
For example, the two-byte event ff 00 contains a complete vendor-event
header declaring zero parameters. The old classifier still reads a
nonexistent third byte and can misclassify the event as a coredump if the
adjacent byte is 0x34.
Require the HCI event header and first parameter to be present before
inspecting the Realtek subevent code. Short events continue through the
normal HCI receive path, which owns their protocol validation.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8de58bfa26e028f99271dde5a92107cd07f5e063",
"status": "affected",
"version": "044014ce85a17c0b7fab8e5df0925792010c29b2",
"versionType": "git"
},
{
"lessThan": "400267bab0f4076088e163e58cad2bb41c3cf5e7",
"status": "affected",
"version": "044014ce85a17c0b7fab8e5df0925792010c29b2",
"versionType": "git"
},
{
"lessThan": "8881daaafadbe7fb2b7341d16a3949114409c90c",
"status": "affected",
"version": "044014ce85a17c0b7fab8e5df0925792010c29b2",
"versionType": "git"
},
{
"lessThan": "24b0758193d70da47ef8b979153d2a181dbdf34e",
"status": "affected",
"version": "044014ce85a17c0b7fab8e5df0925792010c29b2",
"versionType": "git"
},
{
"lessThan": "df541cd485ff80a5ddc579d99687bc7506df9851",
"status": "affected",
"version": "044014ce85a17c0b7fab8e5df0925792010c29b2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: validate Realtek vendor event length\n\nbtusb_recv_event_realtek() reads the event code at data[0] and the Realtek\nsubevent code at data[2] before deciding whether to consume a vendor event\nas a coredump.\n\nFor example, the two-byte event ff 00 contains a complete vendor-event\nheader declaring zero parameters. The old classifier still reads a\nnonexistent third byte and can misclassify the event as a coredump if the\nadjacent byte is 0x34.\n\nRequire the HCI event header and first parameter to be present before\ninspecting the Realtek subevent code. Short events continue through the\nnormal HCI receive path, which owns their protocol validation."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:03:38.589Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8de58bfa26e028f99271dde5a92107cd07f5e063"
},
{
"url": "https://git.kernel.org/stable/c/400267bab0f4076088e163e58cad2bb41c3cf5e7"
},
{
"url": "https://git.kernel.org/stable/c/8881daaafadbe7fb2b7341d16a3949114409c90c"
},
{
"url": "https://git.kernel.org/stable/c/24b0758193d70da47ef8b979153d2a181dbdf34e"
},
{
"url": "https://git.kernel.org/stable/c/df541cd485ff80a5ddc579d99687bc7506df9851"
}
],
"title": "Bluetooth: btusb: validate Realtek vendor event length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68339",
"datePublished": "2026-08-10T12:03:15.551Z",
"dateReserved": "2026-07-30T09:28:09.384Z",
"dateUpdated": "2026-08-17T05:03:38.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…