CVE-2026-11893 in Zephyr
Summary
by MITRE • 08/11/2026
The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, violates the bt_hci_driver_api.send() buffer-ownership contract. That contract (documented at include/zephyr/drivers/bluetooth.h) requires the buffer reference to be consumed only on success; on error the caller still owns the reference and unrefs it. The driver instead routed all error paths through a shared label that unconditionally called net_buf_unref(buf) before returning the error code, consuming the buffer on failure as well.
When send() returns an error, the host TX path (send_buf() in subsys/bluetooth/host/conn.c) unrefs the same buffer again, believing it still owns it. This double-unref over-decrements the net_buf reference count. Because the buffer is a TX fragment whose destroy callback also decrements its still-queued parent buffer, the parent is freed prematurely while reachable on the connection TX queue, producing a use-after-free and corruption of the shared net_buf pool rather than a benign leak.
The error conditions are on the host-to-controller transmit path (controller send failure, or an unsupported H:4 packet type), so they are not driven directly by attacker-supplied radio bytes; a remote/adjacent peer can influence them only indirectly, e.g. by inducing controller TX failures under heavy link load. The consequence when reached is BLE-stack denial of service (crash / pool corruption) with possible further memory corruption, bounded to devices using one of these Bouffalo Lab on-chip controllers.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability identified in the Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers represents a critical buffer management flaw that violates fundamental API contract principles within the Zephyr RTOS framework. This issue manifests in the bt_bflb_send() function located at drivers/bluetooth/hci/hci_bflb.c, where the driver fails to properly adhere to the documented bt_hci_driver_api.send() buffer-ownership contract. The contract explicitly mandates that buffer references must only be consumed upon successful operation, while error conditions require the caller to maintain ownership and perform proper unref operations. This fundamental violation creates a cascading failure scenario that impacts system stability and security integrity.
The technical implementation flaw occurs through improper error handling pathways within the driver code where all error conditions are routed through a shared label that unconditionally executes net_buf_unref(buf) before returning error codes. This unconditional buffer release on failure directly contradicts the established API contract, causing the buffer to be consumed even when operations fail. The host TX path in subsys/bluetooth/host/conn.c subsequently attempts to perform another unref operation on what it believes is still an owned reference, resulting in a double-unref condition that fundamentally corrupts the net_buf reference counting mechanism. This error pattern aligns with CWE-459, which describes "Incomplete Cleanup" vulnerabilities where resources are not properly released leading to system instability.
The operational impact of this vulnerability extends beyond simple resource leaks to encompass serious memory corruption and system instability issues. When the double-unref occurs, it over-decrements the net_buf reference count causing premature buffer deallocation while the buffer remains reachable on the connection TX queue. This creates a use-after-free condition that corrupts the shared net_buf pool, potentially leading to complete BLE stack denial of service through crashes or more subtle memory corruption issues. The vulnerability is classified under ATT&CK technique T1499.004 for "Fragging" and represents a critical system stability threat that can be triggered through legitimate host-to-controller communication pathways. The error conditions are specifically tied to the host-to-controller transmit path, including controller send failures or unsupported H:4 packet types, making this vulnerability reachable through normal operational scenarios rather than direct attacker manipulation.
Mitigation strategies for this vulnerability require immediate attention at both the driver level and system architecture. The primary fix involves modifying the bt_bflb_send() function to ensure error paths properly preserve buffer ownership semantics by avoiding unconditional unref operations on failure conditions. System-level mitigations should include enhanced buffer validation routines, improved reference counting monitoring, and potentially runtime checks for buffer integrity. Organizations using Bouffalo Lab BL60x/BL70x/BL61x controllers must prioritize firmware updates that address this specific API contract violation, as the vulnerability affects all devices utilizing these particular BLE controller implementations. The impact is bounded to devices employing these specific hardware components, but given their use in various IoT and embedded systems, the potential for widespread disruption remains significant. This vulnerability demonstrates the critical importance of maintaining strict adherence to established API contracts in embedded systems development, particularly when dealing with shared memory resources and complex driver architectures that interface directly with critical system components.