CVE-2026-68479

Bluetooth: btrtl: validate firmware patch bounds

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btrtl: validate firmware patch bounds

rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow and turn the copy into an oversized read and write during Bluetooth setup.

The existing patch_offset + patch_length check can also wrap on 32-bit architectures. Validate the patch length and range without arithmetic overflow before allocating or copying the patch.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before 39e01b4addfbbe177567d6ed1dfb81f9cccb19e6Affected db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before bda3c598ade6ea03884074b91e31608326684921Affected db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before a4cb830e0b55ac76c849fd7840afb251f4c028faAffected db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before 68c5a2a19987c035eb129e627e579adafb04f637Affected db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before 83534891c058ed71e251135072640911670869aaAffected db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before 6744ab60dfac55d1df5733960aad5be300984301Affected db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before f1ca750c0510bdbb504bf084d2f196ef2af92ea6Affected db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before 609c5b04a28dc1b0f3af6a7bc93055135b2d2059Affected
LinuxLinux	4.2Affected before 4.2Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before 39e01b4addfbbe177567d6ed1dfb81f9cccb19e6Affected
db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before bda3c598ade6ea03884074b91e31608326684921Affected
db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before a4cb830e0b55ac76c849fd7840afb251f4c028faAffected
db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before 68c5a2a19987c035eb129e627e579adafb04f637Affected
db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before 83534891c058ed71e251135072640911670869aaAffected
db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before 6744ab60dfac55d1df5733960aad5be300984301Affected
db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before f1ca750c0510bdbb504bf084d2f196ef2af92ea6Affected
db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to before 609c5b04a28dc1b0f3af6a7bc93055135b2d2059Affected

LinuxLinux

4.2Affected
before 4.2Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.