CVE-2026-11894
Received Received - Intake

Double-Free in Realtek BEE Bluetooth HCI Driver

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Zephyr Project

Description
The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api buffer-ownership contract. That contract requires the driver to consume (unref) the transmit net_buf only on success; on an error return the host caller retains ownership and unrefs the buffer itself. The pre-fix code routed all error paths through a shared cleanup label that unconditionally called net_buf_unref(buf) before returning the error code. Because the host TX paths (in subsys/bluetooth/host/hci_core.c) unref the buffer again after send() returns an error, the buffer is freed twice: the driver returns it to its net_buf pool and the host then unrefs the already-freed buffer, corrupting the shared pool / underflowing the reference count (CWE-415). The same error branch additionally dereferenced buf->len inside a LOG_ERR call after the buffer had already been unref'd, a read of freed memory (CWE-416) that is compiled in at the default error log level. The failing edges are reached when the controller's host-to-controller buffer allocation fails or the controller send fails (resource-exhaustion / IO conditions). A remote Bluetooth peer can push the device toward these conditions indirectly by driving heavy host transmit activity, at which point the double-free corrupts the host net_buf pool and most likely crashes the device, with residual potential for further memory corruption. The impact is confined to builds using this specific Realtek BEE HCI driver. The fix returns early from each error path without unreffing and unrefs the buffer only on the success path, restoring the ownership contract and eliminating both the double-free and the use-after-free read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-11894
EUVD
EUVD-2026-55937

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
zephyrproject zephyr 4.4.0
zephyrproject zephyr 4.4.1
zephyrproject zephyr 4.4.2
zephyrproject zephyr 4.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a double-free and use-after-free issue in the Realtek BEE Bluetooth HCI driver for Zephyr RTOS. The driver's send callback incorrectly freed a transmit buffer on error paths before returning an error code, violating the buffer-ownership contract. This caused the host caller to free the buffer again, leading to memory corruption and potential crashes. The issue occurs when the controller's buffer allocation or send fails, often due to resource exhaustion or heavy Bluetooth activity from a remote peer.

Detection Guidance

Detecting this vulnerability requires checking if your system uses the vulnerable Realtek BEE Bluetooth HCI driver in Zephyr RTOS. Inspect the driver version and Zephyr build configuration. Look for crashes or memory corruption in Bluetooth operations, especially under heavy load. Check logs for double-free or use-after-free errors in net_buf operations.

Impact Analysis

The vulnerability can cause system crashes due to memory corruption in the shared net_buf pool. It may also lead to further memory corruption or instability, especially if triggered repeatedly by a remote Bluetooth peer driving heavy host transmit activity. The impact is limited to devices using the specific Realtek BEE HCI driver in Zephyr RTOS versions 4.4.0 to 4.4.1.

Compliance Impact

This vulnerability primarily impacts system reliability and availability due to double-free and use-after-free issues in the Bluetooth driver. It does not directly expose or leak sensitive data, so its impact on GDPR or HIPAA compliance is likely minimal unless the system crash disrupts data processing or availability of critical services.

Mitigation Strategies

Upgrade Zephyr RTOS to version 4.4.2 or later where the issue is fixed. If upgrading is not possible, disable the Realtek BEE Bluetooth HCI driver by removing it from the build configuration. Monitor Bluetooth operations for crashes or memory corruption and apply vendor patches if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11894. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart