CVE-2026-11893: Double Free in Zephyr RTOS Bluetooth HCI Driver Corrupts BLE Stack Memory

TL;DR: The Bouffalo Lab Bluetooth HCI driver in Zephyr RTOS frees a transmit buffer on every error path, violating the buffer-ownership contract. The host stack then frees the same buffer again, causing a double free that corrupts the shared net_buf pool. Affects devices using BL60x, BL70x, or BL61x BLE controllers. Fixed in Zephyr 4.4.2.

What happened

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers has a bug in its error handling. The function bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c routes every error condition through a shared cleanup label that calls net_buf_unref(buf) before returning the error code. That call consumes the buffer reference on failure.

The problem is that the Zephyr Bluetooth HCI driver contract says the opposite should happen. The bt_hci_driver_api.send() contract, documented at include/zephyr/drivers/bluetooth.h, requires the driver to consume the buffer reference only on success. On error, the caller still owns the reference and is responsible for unreffing it.

When send() returns an error, the host TX path in subsys/bluetooth/host/conn.c calls net_buf_unref() on the same buffer, believing it still owns the reference. This second unref over-decrements the reference count. The buffer is a TX fragment whose destroy callback also decrements its parent buffer, which is still queued on the connection TX queue. The parent gets freed prematurely while reachable, producing a use-after-free rather than a benign leak.

The corruption hits the shared net_buf pool, which all Bluetooth stack allocations draw from. A corrupted pool means future allocations can return overlapping or already-freed memory, with consequences that extend well beyond the single packet that triggered the bug.

Who is affected

Zephyr RTOS is an open-source real-time operating system maintained by the Linux Foundation. It targets embedded devices ranging from IoT sensors to wearable electronics to industrial controllers. Major silicon vendors including Nordic Semiconductor, NXP, and Bouffalo Lab contribute board support and driver code.

This vulnerability specifically affects devices using Bouffalo Lab on-chip BLE controllers: the BL60x, BL70x, and BL61x series. These are low-cost Wi-Fi and Bluetooth combo chips popular in consumer IoT products, smart home devices, and budget wireless modules. Any Zephyr build that enables the hci_bflb driver and runs an earlier release than 4.4.2 is affected.

The error conditions sit on the host-to-controller transmit path. An adjacent radio peer can influence them only indirectly, for example by inducing controller TX failures under heavy link load. The attack complexity is high (CVSS 3.1 vector: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H, base score 5.9 MEDIUM). The practical outcome is BLE-stack denial of service: a crash or pool corruption with possible further memory damage.

What to do

Update to Zephyr 4.4.2 or later. The fix corrects the driver so error paths no longer call net_buf_unref(buf), leaving buffer ownership with the caller as the contract requires.

For projects that cannot update immediately, the mitigation is limited. The vulnerable driver only loads when CONFIG_BT_HCI_BFLB is enabled. If your device does not use a Bouffalo Lab BLE controller, disable this config option to eliminate the attack surface. If it does, reducing sustained Bluetooth traffic load decreases the probability of hitting the TX error paths that trigger the double free.

Why it matters

Double-free bugs in embedded Bluetooth stacks are dangerous because the shared buffer pool corrupted by the initial trigger remains in active use. A single misfreed buffer can cascade into heap corruption that affects unrelated connections and protocol layers. On resource-constrained devices running Zephyr, there is typically no memory protection between stack components. A corrupted net_buf pool is a system-wide problem.

The CWE classification is CWE-415 (Double Free). The Zephyr security team published the fix as commit 76d92d502b30218aaf11cbbe1be180a317627bb9 with advisory GHSA-ph42-6rqx-728c. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog and there are no public exploit tools targeting it.

References

• CVE-2026-11893 on hol.org
• Zephyr fix commit
• Zephyr security advisory GHSA-ph42-6rqx-728c