CVE-2026-68339

A flaw was found in the Linux kernel's Bluetooth subsystem (btusb driver). An attacker could craft a two-byte vendor event that, due to improper validation of the Realtek vendor event length in the btusb_recv_event_realtek() function, could lead to the system attempting to read a non-existent third byte. This misclassification of the event as a coredump could result in a denial of service (DoS).

This issue affects Realtek USB Bluetooth adapters (btusb). Short vendor events are not length-validated before parsing, allowing OOB read on two-byte events. Systems without Realtek btusb devices are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the btusb module from loading. See https://access.redhat.com/solutions/41278 for instructions.