CVE-2026-78117

Name of the Vulnerable Software and Affected Versions Infineon PSOC 6 BLESS HCI driver (affected versions not specified)

Description The driver stores the outgoing HCI packet descriptor in a file-scope variable hci tx pkt. The function psoc6 bless send() populates the packetType, dataLength, and data fields of this descriptor before acquiring the psoc6 bless operation sem semaphore. Because the semaphore only protects the call to Cy BLE SoftHciSendAppPkt() and not the shared state, concurrent senders can interleave their operations.

This race condition allows the controller to receive a descriptor with mismatched dataLength and data pointers, or a pointer to a buffer already returned to its pool. Consequently, the controller may transmit up to a full HCI/ACL payload starting from a shorter or recycled buffer, leading to the disclosure of adjacent RAM contents to a connected peer. Additionally, this can cause HCI packets to be duplicated or dropped, disrupting the link.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.