TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

TOTOLINK/Realtek Routers - Information Disclosure

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...

TOTOLINK/Realtek Routers - Information Disclosure

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...

RealTek Jungle SDK - Arbitrary Command Injection

There is a command injection vulnerability on the "formWsc" page of the management interface. Successful exploitation of this vulnerability could lead to remote code execution and compromise of the affected system. id: CVE-2021-35395 info: name: RealTek Jungle SDK - Arbitrary Command Injection...

The vulnerability of the rtl8xxxu_probe() function in the drivers/net/wireless/realtek/rtl8xxxu/core.c driver for Realtek wireless adapter drivers in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the rtl8xxxuprobe function in the drivers/net/wireless/realtek/rtl8xxxu/core.c file of the Realtek wireless adapter driver for the Linux operating system is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow a remot...

CVE-2026-11894

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11894

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11894 Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11894

The CVE-2026-11894 entry concerns Realtek’s BEE Bluetooth HCI driver (bt_hci_bee_send in drivers/bluetooth/hci/hci_bee.c). The vulnerability arises from violating the bt_hci_driver_api buffer-ownership contract: on error, the host should retain and unref the transmit net_buf, but the pre-fix code...

EUVD-2026-55937

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-11894 Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

PT-2026-70060

Name of the Vulnerable Software and Affected Versions Realtek BEE Bluetooth HCI driver affected versions not specified Description The bt hci bee send function in drivers/bluetooth/hci/hci bee.c violates the buffer-ownership contract of the bt hci driver api. The driver incorrectly releases the...

CVE-2026-68339

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

CVE-2026-68339 Bluetooth: btusb: validate Realtek vendor event length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

EUVD-2026-55440

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

CVE-2026-68339

The Linux kernel Bluetooth btusb vulnerability CVE-2026-68339 stems from btusb_recv_event_realtek() inspecting data[0] and data[2] before verifying the HCI event header and first parameter. This can cause misclassification of a vendor event as a coredump (e.g., a 2-byte event ff 00 with adjacent ...

EUVD-2026-55315

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832: fix use-after-free in rtl2832remove canceldelayedworksync is called before i2cmuxdeladapters in rtl2832remove. While the cancel waits for any running instance of i2cgatework to finish, it does not prevent the time...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2026-64506

A flaw was found in the Realtek 802.11ac wireless driver rtw89 within the Linux kernel. A remote attacker, within adjacent network range, could send specially crafted malformed Aggregated MAC Protocol Data Unit AMPDU frames. This incorrect handling of frames, particularly during rekey processes,...

CVE-2026-64536 staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in isapintkip IE loop The loop in isapintkip iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE-elementid and pIE-length are rea...