CVE-2026-68479

A flaw was found in the Linux kernel's Bluetooth btrtl module. This vulnerability allows a local attacker to provide a specially crafted firmware patch during Bluetooth setup. This can cause an integer underflow, leading to an oversized read and write operation. Such an operation can result in memory corruption, potentially enabling a denial of service or arbitrary code execution.

rtlbt_parse_firmware() can process a malformed Realtek Bluetooth firmware patch with a patch_length smaller than the firmware version field. The subtraction used for the copy length can underflow and turn the copy into an oversized read and write during Bluetooth setup, and the old patch_offset plus patch_length range check can also wrap on 32-bit systems. This is a local firmware input attack rather than a Bluetooth over the air attack, because the attacker normally needs a way to place or influence the firmware blob loaded by the kernel. For the CVSS the PR:L is used in the paranoid score because some deployments may delegate firmware update or device setup control to a reduced capability service account or container context, while the normal host configuration is closer to PR:H. Impact is kernel memory corruption with at least denial of service and a plausible privilege escalation risk if a less privileged actor can control the firmware blob.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.