CVE-2026-77685

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.3.0 through 4.4.0

Description The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c contains an integer underflow when computing the echo length for a BT RFCOMM TEST command. A malformed UIH frame on DLCI 0 can cause buf->len to be 0, resulting in buf->len - 1 underflowing to 255. This value is passed to the rfcomm send test() function, which then copies 255 bytes from a receive buffer that contains no valid data. This process leads to an out-of-bounds read of adjacent stack or pool memory and an out-of-bounds write that overruns the transmit buffer by approximately eight bytes, potentially crashing the Bluetooth host.

The issue can be triggered by an unpaired BR/EDR device within radio range of a target with CONFIG BT RFCOMM enabled (such as SPP, HFP, HSP, or GOEP profiles). The vulnerability is specifically exploitable in builds where CONFIG BT GOEP is enabled, as it increases the receive MTU beyond the transmit MTU.

Recommendations Update Zephyr to a version that includes both Fix 1 (addressing the underflow and over-read) and Fix 2 (addressing the transmit buffer overrun by checking tailroom on every RFCOMM PDU allocation).