{"id":"CVE-2026-68479","title":"Bluetooth: btrtl: validate firmware patch bounds","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: validate firmware patch bounds\n\nrtlbt_parse_firmware() copies patch_length - 4 bytes before appending the\nfirmware version. A malformed firmware patch…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 39e01b4addfbbe177567d6ed1dfb81f9cccb19e6","Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < bda3c598ade6ea03884074b91e31608326684921","Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < a4cb830e0b55ac76c849fd7840afb251f4c028fa","Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 68c5a2a19987c035eb129e627e579adafb04f637","Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 83534891c058ed71e251135072640911670869aa","Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 6744ab60dfac55d1df5733960aad5be300984301","Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < f1ca750c0510bdbb504bf084d2f196ef2af92ea6","Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 609c5b04a28dc1b0f3af6a7bc93055135b2d2059","Linux 4.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:49:41.950928Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:15.358Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68479","references":[{"url":"https://git.kernel.org/stable/c/39e01b4addfbbe177567d6ed1dfb81f9cccb19e6"},{"url":"https://git.kernel.org/stable/c/bda3c598ade6ea03884074b91e31608326684921"},{"url":"https://git.kernel.org/stable/c/a4cb830e0b55ac76c849fd7840afb251f4c028fa"},{"url":"https://git.kernel.org/stable/c/68c5a2a19987c035eb129e627e579adafb04f637"},{"url":"https://git.kernel.org/stable/c/83534891c058ed71e251135072640911670869aa"},{"url":"https://git.kernel.org/stable/c/6744ab60dfac55d1df5733960aad5be300984301"},{"url":"https://git.kernel.org/stable/c/f1ca750c0510bdbb504bf084d2f196ef2af92ea6"},{"url":"https://git.kernel.org/stable/c/609c5b04a28dc1b0f3af6a7bc93055135b2d2059"}],"tags":["cve.org"],"epss":0.00169,"epssPercentile":0.05784,"ingestedAt":"2026-10-16T17:24:46.872Z","slug":"CVE-2026-68479","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: validate firmware patch bounds\n\nrtlbt_parse_firmware() copies patch_length - 4 bytes before appending the\nfirmware version. A malformed firmware patch shorter than the version field\ncan make this subtraction underflow and turn the copy into an oversized\nread and write during Bluetooth setup.\n\nThe existing patch_offset + patch_length check can also wrap on 32-bit\narchitectures. Validate the patch length and range without arithmetic\noverflow before allocating or copying the patch.\n\n## Affected\n\n- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 39e01b4addfbbe177567d6ed1dfb81f9cccb19e6`\n- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < bda3c598ade6ea03884074b91e31608326684921`\n- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < a4cb830e0b55ac76c849fd7840afb251f4c028fa`\n- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 68c5a2a19987c035eb129e627e579adafb04f637`\n- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 83534891c058ed71e251135072640911670869aa`\n- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 6744ab60dfac55d1df5733960aad5be300984301`\n- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < f1ca750c0510bdbb504bf084d2f196ef2af92ea6`\n- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 609c5b04a28dc1b0f3af6a7bc93055135b2d2059`\n- `Linux 4.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}