{"id":"CVE-2026-68479","revision":"d8d114581e7743e692e280e2f6a1b38a","records":[{"revision":"d8d114581e7743e692e280e2f6a1b38a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68479","aliases":[],"title":"Bluetooth: btrtl: validate firmware patch bounds","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: validate firmware patch bounds\n\nrtlbt_parse_firmware() copies patch_length - 4 bytes before appending the\nfirmware version. A malformed firmware patch shorter than the version field\ncan make this subtraction underflow and turn the copy into an oversized\nread and write during Bluetooth setup.\n\nThe existing patch_offset + patch_length check can also wrap on 32-bit\narchitectures. Validate the patch length and range without arithmetic\noverflow before allocating or copying the patch.","state":0,"publishedAt":"2026-08-15T05:51:34.106+00:00","modifiedAt":"2026-10-19T21:09:12.177+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bluetooth/btrtl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647\",\n                            \"lessThan\": \"39e01b4addfbbe177567d6ed1dfb81f9cccb19e6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647\",\n                            \"lessThan\": \"bda3c598ade6ea03884074b91e31608326684921\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647\",\n                            \"lessThan\": \"a4cb830e0b55ac76c849fd7840afb251f4c028fa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647\",\n                            \"lessThan\": \"68c5a2a19987c035eb129e627e579adafb04f637\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647\",\n                            \"lessThan\": \"83534891c058ed71e251135072640911670869aa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647\",\n                            \"lessThan\": \"6744ab60dfac55d1df5733960aad5be300984301\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647\",\n                            \"lessThan\": \"f1ca750c0510bdbb504bf084d2f196ef2af92ea6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647\",\n                            \"lessThan\": \"609c5b04a28dc1b0f3af6a7bc93055135b2d2059\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bluetooth/btrtl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.261\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.97\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.40\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.5\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/39e01b4addfbbe177567d6ed1dfb81f9cccb19e6","https://git.kernel.org/stable/c/bda3c598ade6ea03884074b91e31608326684921","https://git.kernel.org/stable/c/a4cb830e0b55ac76c849fd7840afb251f4c028fa","https://git.kernel.org/stable/c/68c5a2a19987c035eb129e627e579adafb04f637","https://git.kernel.org/stable/c/83534891c058ed71e251135072640911670869aa","https://git.kernel.org/stable/c/6744ab60dfac55d1df5733960aad5be300984301","https://git.kernel.org/stable/c/f1ca750c0510bdbb504bf084d2f196ef2af92ea6","https://git.kernel.org/stable/c/609c5b04a28dc1b0f3af6a7bc93055135b2d2059"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68479","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68479","identifiers":["CVE-2026-68479"]},"retained":false,"historicalAffected":[]}],"coverage":[]}