What’s Vulnerable › Vulnerabilities

CVE-2026-68339: Bluetooth: btusb: validate Realtek vendor event length

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-10 · updated 2026-08-17

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusb_recv_event_realtek() reads the event code at data[0] and the Realtek subevent code at data[2] before deciding whether to consume a vendor event as a coredump. For example, the two-byte event ff 00 contains a complete vendor-event header declaring zero parameters. The old classifier still reads a nonexistent third byte and can misclassify the event as a coredump if the adjacent byte is 0x34. Require the HCI event header and first parameter to be present before inspecting the Realtek subevent code. Short events continue through the normal HCI receive path, which owns their protocol validation.

Affected products

• Linux kernel: 6.6 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/24b0758193d70da47ef8b979153d2a181dbdf34e
• https://git.kernel.org/stable/c/400267bab0f4076088e163e58cad2bb41c3cf5e7
• https://git.kernel.org/stable/c/8881daaafadbe7fb2b7341d16a3949114409c90c
• https://git.kernel.org/stable/c/8de58bfa26e028f99271dde5a92107cd07f5e063
• https://git.kernel.org/stable/c/df541cd485ff80a5ddc579d99687bc7506df9851

Get alerted when CVE-2026-68339 or the next vulnerability affects your stack