CVE-2026-90832

bt hci le per adv report common() in subsys/bluetooth/host/scan.c handles the HCI LE Periodic Advertising Report (and v2) event. It verified that the fixed event header was present and that the controller-declared Data Length fits the tailroom of the periodic-sync reassembly buffer, but never checked that the event actually carried as many data bytes as evt->length claims. Both reassembly paths — DATA STATUS PARTIAL, and DATA STATUS COMPLETE while a chain is already in progress — then called net buf simple add mem(&per adv sync->reassembly, buf->data, evt->length), copying up to 255 bytes starting past the end of the event's real payload.

The Data Length field originates in the HCI controller, so the flaw is reachable in host-only/split builds where the controller is a separate part reached over H4 UART, SPI, USB or an inter-core IPC transport: a malicious, compromised or buggy controller (or an attacker able to inject on that link) can send a report declaring a length larger than the event payload. The generic event dispatcher in subsys/bluetooth/host/hci core.c only enforces a per-event minimum length and never cross-checks the subevent's internal length field, so nothing else catches it. Builds using Zephyr's own in-image controller are not affected, because the controller always emits a length matching the bytes it appends.

Exploitation additionally requires CONFIG BT PER ADV SYNC with CONFIG BT PER ADV SYNC BUF SIZE > 0 (the option defaults to 0, which compiles the reassembly block out; LE Audio broadcast-sink and Public Broadcast Profile applications that reassemble fragmented periodic advertising data set it), and an established periodic advertising sync.

The consequence is an out-of-bounds read of adjacent HCI RX-pool memory — including stale contents of previously received HCI events — which is copied into the reassembly buffer and then delivered to every registered bt le per adv sync cb.recv listener as if it were received advertising data, so the disclosed memory becomes application-visible and may be forwarded off-device. The write side remains in bounds because the tailroom check uses the same length value, so there is no memory corruption; impact is limited to information disclosure and undefined behaviour on the over-read. The fix drops any report whose declared length exceeds the remaining event payload, matching the guard already present in the extended and legacy advertising report handlers.