CVE-2026-11893

Name of the Vulnerable Software and Affected Versions Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x) (affected versions not specified)

Description The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers contains an issue where the bt bflb send() function in drivers/bluetooth/hci/hci bflb.c violates the buffer-ownership contract of bt hci driver api.send(). The driver unconditionally calls net buf unref(buf) on all error paths, whereas the contract requires the buffer reference to be consumed only upon success. This leads to a double-unref when the host TX path, specifically the send buf() function in subsys/bluetooth/host/conn.c, unrefs the same buffer again after receiving an error.

This process over-decrements the net buf reference count, causing a parent buffer to be freed prematurely while still reachable on the connection TX queue. This results in a use-after-free condition and corruption of the shared net buf pool. The issue can be triggered on the host-to-controller transmit path during controller send failures or when using an unsupported H:4 packet type. A remote or adjacent peer may indirectly influence this by inducing controller TX failures under heavy link load, potentially leading to a BLE-stack denial of service, system crash, or further memory corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.