TL;DR: CVE-2026-11894 is a double-free and use-after-free in the Realtek BEE Bluetooth HCI driver in the Zephyr RTOS. A remote Bluetooth peer can drive heavy host transmit activity to trigger the bug, corrupting the net buffer pool and crashing the device. The fix is in Zephyr 4.4.2.

What happened

The Realtek BEE Bluetooth HCI driver implements bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c. This function is the transmit callback registered against Zephyr's bt_hci_driver_api interface. The buffer ownership contract for that interface is specific: the driver must consume (unref) the transmit net_buf only on success. On an error return, ownership stays with the caller, and the host stack unrefs the buffer itself.

The pre-fix code violated that contract. All error paths routed through a shared cleanup label that called net_buf_unref(buf) unconditionally before returning the error code. When send() returned an error, the Zephyr Bluetooth host in subsys/bluetooth/host/hci_core.c unref'd the same buffer again. Two frees against a net_buf that the pool already reclaimed. The shared pool gets corrupted. The reference count underflows.

The same error branch added a second bug. After calling net_buf_unref(buf), the code dereferenced buf->len in a LOG_ERR call. That is a read of freed memory, compiled in at the default error log level.

The failing edges are reached when the controller's host-to-controller buffer allocation fails or the controller send fails. These are resource-exhaustion or I/O conditions. A remote Bluetooth peer can push toward these conditions by driving heavy host transmit activity. When the error path fires, the double-free corrupts the host net_buf pool. The most likely outcome is a fatal device crash. Residual potential for further memory corruption exists.

Who is affected

The affected package is zephyr from the zephyrproject namespace. Fixed in version 4.4.2. The vulnerability is confined to builds that use the specific Realtek BEE HCI driver hci_bee.c. Builds using other Bluetooth controllers are not affected.

Zephyr is an open-source real-time operating system maintained under the Linux Foundation's Zephyr Project. It targets resource-constrained IoT and embedded devices: wearables, sensors, smart home controllers, industrial endpoints, and Bluetooth peripherals. Zephyr is deployed in millions of devices across consumer and industrial markets. The Realtek BEE chipset family powers Bluetooth radios in a range of IoT modules and development boards.

Devices running firmware built from Zephyr source with the Realtek BEE driver enabled and a registered Bluetooth controller are exposed. A remote Bluetooth peer within radio range can trigger the bug without authentication by generating enough Bluetooth traffic to exhaust host-to-controller buffers.

What to do

Upgrade to Zephyr 4.4.2 or later. The fix returns early from each error path without unreffing the buffer. The buffer is unref'd only on the success path. This restores the ownership contract and eliminates both the double-free and the use-after-free read.

If you ship devices that cannot be updated immediately:

• Disable or rate-limit Bluetooth transmit activity in your application firmware to reduce the probability of hitting the error paths.
• Verify that your build includes the Realtek BEE driver. If your device uses a different HCI driver, this CVE does not apply.
• Review your Bluetooth controller's buffer configuration. Larger host-to-controller buffer pools make resource exhaustion less likely to trigger.

Why it matters

Double-free bugs are memory corruption primitives. The immediate effect here is a device crash: a denial of service. The longer-term risk is what a corrupted net_buf pool enables. Depending on allocator behavior and timing, a double-free can be leveraged into arbitrary code execution on devices where the Bluetooth stack runs in a privileged context. IoT devices running Zephyr often have no memory protection unit or a minimal one, making exploitation more feasible than on a desktop OS.

The remote trigger vector is the part that elevates this above a reliability bug. A Bluetooth peer does not need credentials or a paired connection to generate traffic that stresses the host transmit path. Any device within radio range can issue connection requests, L2CAP signaling, and ACL data that forces the Zephyr host to allocate and transmit buffers. When those transmissions fail, the double-free fires.

NVD enrichment is pending. The CVE was published on the hol.org feed on August 11, 2026.

References

• hol.org CVE feed
• NVD entry (pending)
• Zephyr 4.4.2 release notes
• Source: drivers/bluetooth/hci/hci_bee.c in Zephyr RTOS
• CWE-415 (Double Free), CWE-416 (Use After Free)