CVE-2026-68339

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: validate Realtek vendor event length

btusb_recv_event_realtek() reads the event code at data[0] and the Realtek

subevent code at data[2] before deciding whether to consume a vendor event

as a coredump.

For example, the two-byte event ff 00 contains a complete vendor-event

header declaring zero parameters. The old classifier still reads a

nonexistent third byte and can misclassify the event as a coredump if the

adjacent byte is 0x34.

Require the HCI event header and first parameter to be present before

inspecting the Realtek subevent code. Short events continue through the

normal HCI receive path, which owns their protocol validation.