CVE-2026-68479: Bluetooth: btrtl: validate firmware patch bounds
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btrtl: validate firmware patch bounds
rtlbtparsefirmware() copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow and turn the copy into an oversized read and write during Bluetooth setup.
The existing patchoffset + patchlength check can also wrap on 32-bit architectures. Validate the patch length and range without arithmetic overflow before allocating or copying the patch.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68479?
CVE-2026-68479 has a risk rating of 55.
How do I fix CVE-2026-68479?
To fix CVE-2026-68479, ensure you apply the latest updates to the Linux kernel that address this vulnerability.
What systems are affected by CVE-2026-68479?
CVE-2026-68479 affects Linux kernel versions that utilize the Bluetooth btrtl driver.
What type of vulnerability is CVE-2026-68479?
CVE-2026-68479 is a buffer underflow vulnerability related to malicious firmware patches in Bluetooth.
What are the potential impacts of CVE-2026-68479?
Exploitation of CVE-2026-68479 could lead to unexpected behavior or crashes in the Bluetooth subsystem.