7 matches found
CVE-2026-68339
A flaw was found in the Linux kernel's Bluetooth subsystem btusb driver. An attacker could craft a two-byte vendor event that, due to improper validation of the Realtek vendor event length in the btusbrecveventrealtek function, could lead to the system attempting to read a non-existent third byte...
DEBIAN-CVE-2026-68339
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...
CVE-2026-68339
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...
UBUNTU-CVE-2026-68339
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...
CVE-2026-68339
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...
CVE-2026-68339 Bluetooth: btusb: validate Realtek vendor event length
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...
CVE-2026-68339
The Linux kernel Bluetooth btusb vulnerability CVE-2026-68339 stems from btusb_recv_event_realtek() inspecting data[0] and data[2] before verifying the HCI event header and first parameter. This can cause misclassification of a vendor event as a coredump (e.g., a 2-byte event ff 00 with adjacent ...