CVE-2026-11893

{
  "id": "CVE-2026-11893",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T05:17:11.567",
  "lastModified": "2026-10-23T19:10:00.167",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, violates the bt_hci_driver_api.send() buffer-ownership contract. That contract (documented at include/zephyr/drivers/bluetooth.h) requires the buffer reference to be consumed only on success; on error the caller still owns the reference and unrefs it. The driver instead routed all error paths through a shared label that unconditionally called net_buf_unref(buf) before returning the error code, consuming the buffer on failure as well.\n\nWhen send() returns an error, the host TX path (send_buf() in subsys/bluetooth/host/conn.c) unrefs the same buffer again, believing it still owns it. This double-unref over-decrements the net_buf reference count. Because the buffer is a TX fragment whose destroy callback also decrements its still-queued parent buffer, the parent is freed prematurely while reachable on the connection TX queue, producing a use-after-free and corruption of the shared net_buf pool rather than a benign leak.\n\nThe error conditions are on the host-to-controller transmit path (controller send failure, or an unsupported H:4 packet type), so they are not driven directly by attacker-supplied radio bytes; a remote/adjacent peer can influence them only indirectly, e.g. by inducing controller TX failures under heavy link load. The consequence when reached is BLE-stack denial of service (crash / pool corruption) with possible further memory corruption, bounded to devices using one of these Bouffalo Lab on-chip controllers."
    },
    {
      "lang": "es",
      "value": "El controlador Bluetooth HCI para controladores BLE en chip de Bouffalo Lab (BL60x/BL70x/BL61x), bt_bflb_send() en drivers/bluetooth/hci/hci_bflb.c, viola el contrato de propiedad de búfer de bt_hci_driver_api.send(). Ese contrato (documentado en include/zephyr/drivers/bluetooth.h) requiere que la referencia del búfer se consuma solo en caso de éxito; en caso de error, el llamador aún posee la referencia y la libera. El controlador en su lugar enrutó todas las rutas de error a través de una etiqueta compartida que llamaba incondicionalmente a net_buf_unref(buf) antes de devolver el código de error, consumiendo el búfer también en caso de fallo.\n\nCuando send() devuelve un error, la ruta TX del host (send_buf() en subsys/bluetooth/host/conn.c) libera el mismo búfer de nuevo, creyendo que todavía lo posee. Esta doble liberación disminuye excesivamente el contador de referencias de net_buf. Debido a que el búfer es un fragmento TX cuya devolución de llamada de destrucción también disminuye su búfer padre aún en cola, el padre se libera prematuramente mientras es accesible en la cola TX de la conexión, produciendo un uso después de liberación y corrupción de la piscina compartida de net_buf en lugar de una fuga benigna.\n\nLas condiciones de error están en la ruta de transmisión del host al controlador (fallo de envío del controlador, o un tipo de paquete H:4 no compatible), por lo que no son impulsadas directamente por bytes de radio suministrados por el atacante; un par remoto/adyacente puede influenciarlas solo indirectamente, p. ej., induciendo fallos de TX del controlador bajo una carga de enlace pesada. La consecuencia cuando se alcanza es una denegación de servicio de la pila BLE (fallo / corrupción de la piscina) con posible corrupción de memoria adicional, limitada a dispositivos que utilizan uno de estos controladores en chip de Bouffalo Lab."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "drivers/bluetooth/hci/hci_bflb.c"
          ],
          "versions": [
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T17:06:22.357982Z",
          "id": "CVE-2026-11893",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-415"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/76d92d502b30218aaf11cbbe1be180a317627bb9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-ph42-6rqx-728c",
      "source": "[email protected]"
    }
  ]
}