CVE-2026-68339

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: validate Realtek vendor event length

btusb_recv_event_realtek() reads the event code at data[0] and the Realtek

subevent code at data[2] before deciding whether to consume a vendor event

as a coredump.

For example, the two-byte event ff 00 contains a complete vendor-event

header declaring zero parameters. The old classifier still reads a

nonexistent third byte and can misclassify the event as a coredump if the

adjacent byte is 0x34.

Require the HCI event header and first parameter to be present before

inspecting the Realtek subevent code. Short events continue through the

normal HCI receive path, which owns their protocol validation.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References