CVE-2026-11894: Realtek BEE Bluetooth Buffer Overflow

CVE-2026-11894 Overview

CVE-2026-11894 is a double-free vulnerability [CWE-415] in the Zephyr RTOS Realtek BEE Bluetooth Host Controller Interface (HCI) driver. The flaw resides in the bt_hci_bee_send() function within drivers/bluetooth/hci/hci_bee.c. The driver violates the bt_hci_driver_api buffer-ownership contract by unconditionally unreferencing the transmit net_buf on error paths. The host caller then unrefs the already-freed buffer, corrupting the shared net_buf pool. A secondary use-after-free read [CWE-416] occurs when buf->len is dereferenced inside a LOG_ERR call after the buffer has been freed.

Critical Impact
A remote Bluetooth peer driving heavy transmit activity can trigger net_buf pool corruption, crash the device, and potentially cause further memory corruption on builds using the Realtek BEE HCI driver.

Affected Products

Zephyr RTOS builds using the Realtek BEE Bluetooth HCI driver (drivers/bluetooth/hci/hci_bee.c)
Devices integrating the bt_hci_driver_api with the affected send callback
Bluetooth-enabled embedded systems built on the vulnerable Zephyr driver

Discovery Timeline

2026-08-11 - CVE-2026-11894 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-11894

Vulnerability Analysis

The bt_hci_driver_api buffer-ownership contract specifies that a driver's send callback consumes and unrefs the transmit net_buf only on success. On error return, the host caller retains ownership and performs the unref itself. The pre-fix implementation of bt_hci_bee_send() routed all error paths through a shared cleanup label that unconditionally called net_buf_unref(buf) before returning the error code.

Because the host TX paths in subsys/bluetooth/host/hci_core.c unref the buffer again after send() returns an error, the buffer is freed twice. The driver returns it to its net_buf pool, and the host then unrefs the already-freed buffer. This corrupts the shared pool and underflows the reference count. The same error branch also dereferences buf->len inside a LOG_ERR call after the buffer has already been unref'd, producing a read of freed memory that is compiled in at the default error log level.

Root Cause

The root cause is a violation of the API buffer-ownership contract. The shared error cleanup label freed the buffer on error paths where the host would also free it. This produced both a double-free [CWE-415] and a use-after-free read [CWE-416] within the logging statement.

Attack Vector

The failing edges are reached when the controller's host-to-controller buffer allocation fails or the controller send fails under resource-exhaustion or I/O conditions. A remote Bluetooth peer within adjacent network range can push the device toward these conditions by driving heavy host transmit activity. The resulting double-free corrupts the host net_buf pool and most likely crashes the device.

static int bt_hci_bee_send(const struct device *dev, struct net_buf *buf)
{
-	int ret = 0;
 	T_RTL_BT_HCI_BUF hci_buf = {};
 	uint8_t packet_type = net_buf_pull_u8(buf);

Source: Zephyr GitHub Commit 9a684b5. The patch removes the shared error cleanup path so error branches return early without unreffing, restoring the ownership contract.

Detection Methods for CVE-2026-11894

Indicators of Compromise

Unexpected device crashes or reboots on Zephyr-based Bluetooth devices under high transmit load
Kernel or Zephyr fault logs referencing net_buf pool corruption or reference count underflow
Repeated LOG_ERR entries originating from bt_hci_bee_send() prior to a device fault
Sustained heavy Bluetooth transmit activity from an adjacent peer preceding device instability

Detection Strategies

Audit firmware builds for inclusion of drivers/bluetooth/hci/hci_bee.c and verify commit 9a684b5c314fb1d8670b01f7b6c4450a9353906c is applied
Enable Zephyr's net_buf pool diagnostics and monitor for reference count anomalies during Bluetooth stress
Instrument HCI error paths with telemetry to identify controller send failures and host buffer allocation failures

Monitoring Recommendations

Collect Bluetooth HCI error logs and correlate with device reset events in a centralized logging platform
Track Bluetooth link statistics for peers generating sustained high-throughput transmit patterns near affected devices
Alert on repeated bt_hci_bee_send() error returns during production operation

How to Mitigate CVE-2026-11894

Immediate Actions Required

Apply the upstream Zephyr fix from commit 9a684b5c314fb1d8670b01f7b6c4450a9353906c and rebuild affected firmware
Inventory all deployed devices that link the Realtek BEE HCI driver and prioritize patch rollout
Restrict Bluetooth pairing and advertising on affected devices in untrusted environments until patched

Patch Information

The fix returns early from each error path in bt_hci_bee_send() without unreffing the buffer, and unrefs the buffer only on the success path. This restores the bt_hci_driver_api ownership contract and eliminates both the double-free and the use-after-free read. See the Zephyr GitHub Security Advisory GHSA-v9mj-h2m6-v9c6 and the remediation commit.

Workarounds

Disable the Realtek BEE HCI driver in builds where Bluetooth is not required
Reduce Bluetooth host transmit load to lower the probability of hitting controller buffer allocation failures
Limit device exposure to untrusted Bluetooth peers by disabling discoverable mode where feasible

bash

# Verify patched commit is present in Zephyr source tree
cd zephyr
git log --oneline drivers/bluetooth/hci/hci_bee.c | grep 9a684b5

# Rebuild firmware with patched driver
west build -b <board> -p always <application>