CVE-2026-79982

Name of the Vulnerable Software and Affected Versions Zephyr Project Zephyr (affected versions not specified)

Description An issue exists in the Bluetooth HCI USB transport class within the USB device stack, specifically in the subsys/usb/device next/class/bt hci.c file. The bt hci tx sync in() function allocates a buffer from bt hci ep pool and uses net buf add mem() to copy controller-to-host HCI packets without performing a length check. Because the pool slots are limited to USBD MAX BULK MPS bytes (64 bytes on full-speed-only builds) while HCI event and ACL buffers can be significantly larger, this leads to a buffer overflow into adjacent memory slots.

When the device operates in raw HCI mode (CONFIG BT HCI RAW), an unauthenticated attacker within Bluetooth range can trigger this by sending oversized ACL fragments via Data Length Extension or broadcasting extended advertising data. In some configurations, the overflow can occur during host initialization via the Read Supported Commands command-complete event. Depending on the build configuration, this can result in silent memory corruption leading to arbitrary code execution on targets lacking memory protection, or a system panic causing a denial of service if assertions are enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.