---
id: CVE-2026-68479
title: 'Bluetooth: btrtl: validate firmware patch bounds'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: btrtl: validate firmware patch bounds

  rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
  firmware version. A malformed firmware patch…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 <
    39e01b4addfbbe177567d6ed1dfb81f9cccb19e6
  - >-
    Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 <
    bda3c598ade6ea03884074b91e31608326684921
  - >-
    Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 <
    a4cb830e0b55ac76c849fd7840afb251f4c028fa
  - >-
    Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 <
    68c5a2a19987c035eb129e627e579adafb04f637
  - >-
    Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 <
    83534891c058ed71e251135072640911670869aa
  - >-
    Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 <
    6744ab60dfac55d1df5733960aad5be300984301
  - >-
    Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 <
    f1ca750c0510bdbb504bf084d2f196ef2af92ea6
  - >-
    Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 <
    609c5b04a28dc1b0f3af6a7bc93055135b2d2059
  - Linux 4.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:49:41.950928Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:15.358Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68479'
references:
  - url: 'https://git.kernel.org/stable/c/39e01b4addfbbe177567d6ed1dfb81f9cccb19e6'
  - url: 'https://git.kernel.org/stable/c/bda3c598ade6ea03884074b91e31608326684921'
  - url: 'https://git.kernel.org/stable/c/a4cb830e0b55ac76c849fd7840afb251f4c028fa'
  - url: 'https://git.kernel.org/stable/c/68c5a2a19987c035eb129e627e579adafb04f637'
  - url: 'https://git.kernel.org/stable/c/83534891c058ed71e251135072640911670869aa'
  - url: 'https://git.kernel.org/stable/c/6744ab60dfac55d1df5733960aad5be300984301'
  - url: 'https://git.kernel.org/stable/c/f1ca750c0510bdbb504bf084d2f196ef2af92ea6'
  - url: 'https://git.kernel.org/stable/c/609c5b04a28dc1b0f3af6a7bc93055135b2d2059'
tags:
  - cve.org
epss: 0.00169
epssPercentile: 0.05784
ingestedAt: '2026-10-16T17:24:46.872Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btrtl: validate firmware patch bounds

rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
firmware version. A malformed firmware patch shorter than the version field
can make this subtraction underflow and turn the copy into an oversized
read and write during Bluetooth setup.

The existing patch_offset + patch_length check can also wrap on 32-bit
architectures. Validate the patch length and range without arithmetic
overflow before allocating or copying the patch.

## Affected

- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 39e01b4addfbbe177567d6ed1dfb81f9cccb19e6`
- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < bda3c598ade6ea03884074b91e31608326684921`
- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < a4cb830e0b55ac76c849fd7840afb251f4c028fa`
- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 68c5a2a19987c035eb129e627e579adafb04f637`
- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 83534891c058ed71e251135072640911670869aa`
- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 6744ab60dfac55d1df5733960aad5be300984301`
- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < f1ca750c0510bdbb504bf084d2f196ef2af92ea6`
- `Linux >= db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 < 609c5b04a28dc1b0f3af6a7bc93055135b2d2059`
- `Linux 4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.