Skip to main content

Linux Kernel CVE-2026-68479

| EUVDEUVD-2026-59101 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-2gq6-hg5j-367v
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local kernel driver flaw exploitable by a low-privilege user with no interaction; full kernel memory corruption justifies H/H/H impact with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.7 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:50 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:20 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 06:20 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btrtl: validate firmware patch bounds

rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow and turn the copy into an oversized read and write during Bluetooth setup.

The existing patch_offset + patch_length check can also wrap on 32-bit architectures. Validate the patch length and range without arithmetic overflow before allocating or copying the patch.

AnalysisAI

Integer underflow and overflow flaws in the Linux kernel's Realtek Bluetooth driver (btrtl) corrupt kernel memory during firmware loading, enabling a local attacker with low privileges to achieve full kernel-level compromise. The vulnerability exists in rtlbt_parse_firmware(), where a malformed firmware patch with a length field smaller than 4 causes a subtraction underflow that transforms a subsequent memcpy into an oversized kernel memory write; a separate addition overflow on 32-bit architectures compounds the exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with the local-only attack vector.

Technical ContextAI

The btrtl driver (drivers/bluetooth/btrtl.c) manages Realtek Bluetooth chipsets and processes vendor firmware patch files at device initialization. The vulnerable function rtlbt_parse_firmware() computes a copy length as patch_length - 4 without first validating that patch_length is at least 4; if the firmware supplies a value of 0-3, the unsigned subtraction underflows to a value near UINT_MAX, causing the subsequent memcpy to read and write far beyond the intended buffer bounds. A second flaw affects 32-bit architectures specifically: the range check patch_offset + patch_length can silently wrap around in 32-bit arithmetic, bypassing the bounds guard entirely. The root cause class is integer underflow/overflow leading to heap buffer overflow (analogous to CWE-191 and CWE-787), though NVD has not yet assigned a formal CWE. The firmware involved is typically distributed in /lib/firmware for supported Realtek Bluetooth chipsets and is loaded by the kernel via the firmware API during Bluetooth subsystem initialization.

RemediationAI

The primary fix is to upgrade to a patched kernel version: 5.10.261 or later for the 5.10.x LTS branch, 5.15.212 or later for 5.15.x LTS, 6.1.178 or later for 6.1.x LTS, 6.6.145 or later for 6.6.x LTS, 6.12.97 or later for 6.12.x LTS, 6.18.40 or later for 6.18.x, 7.1.5 or later for 7.1.x, or 7.2-rc4 or later for the mainline branch. Distribution maintainers tracking these stable branches should receive the fix through normal kernel update channels. For systems where immediate patching is not possible, a targeted workaround is to prevent the btrtl module from loading by blacklisting it: add 'blacklist btrtl' to /etc/modprobe.d/blacklist.conf and rebuild the initramfs. Trade-off: this disables all Realtek Bluetooth functionality. On servers or VMs without Realtek Bluetooth hardware, the btrtl module is typically not loaded and no action beyond scheduled patching is required. Fix commit references: https://git.kernel.org/stable/c/bda3c598ade6ea03884074b91e31608326684921 and the additional stable-tree backports listed in the NVD references.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68479 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy