CVE-2026-68339
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusb_recv_event_realtek() reads the event code at data[0] and the Realtek subevent code at data[2] before deciding whether to consume a vendor event as a coredump. For example, the two-byte event ff 00 contains a complete vendor-event header declaring zero parameters. The old classifier still reads a nonexistent third byte and can misclassify the event as a coredump if the adjacent byte is 0x34. Require the HCI event header and first parameter to be present before inspecting the Realtek subevent code. Short events continue through the normal HCI receive path, which owns their protocol validation.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
Propose a mitigation on Community Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
References
- https://git.kernel.org/stable/c/8de58bfa26e028f99271dde5a92107cd07f5e063
- https://git.kernel.org/stable/c/400267bab0f4076088e163e58cad2bb41c3cf5e7
- https://git.kernel.org/stable/c/8881daaafadbe7fb2b7341d16a3949114409c90c
- https://git.kernel.org/stable/c/24b0758193d70da47ef8b979153d2a181dbdf34e
- https://git.kernel.org/stable/c/df541cd485ff80a5ddc579d99687bc7506df9851
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.