CVE-2026-11894 zephyrproject CVE debrief

Who should care

Users of the Zephyr operating system with the Realtek BEE Bluetooth HCI driver enabled, particularly those with Bluetooth connectivity exposed to untrusted networks, should be aware of this vulnerability. System administrators and security teams responsible for managing Zephyr-based systems with Bluetooth capabilities should prioritize patching and monitoring. Additionally, developers working on Bluetooth-related features in Zephyr should review the driver's implementation to prevent similar issues in the future. Those responsible for vulnerability management and incident response should also be aware of the potential impact and develop strategies for detection and mitigation.

Technical summary

The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send(), in the Zephyr operating system violates the bt_hci_driver_api buffer-ownership contract. This leads to a double-free corruption of the host net_buf pool and potential crashes when a remote Bluetooth peer drives heavy host transmit activity. The pre-fix code routed all error paths through a shared cleanup label that unconditionally called net_buf_unref(buf) before returning the error code, causing the buffer to be freed twice. The fix returns early from each error path without unreffing and unrefs the buffer only on the success path, restoring the ownership contract and eliminating both the double-free and the use-after-free read. Users should review and update Bluetooth HCI driver configurations to ensure secure communication.

Defensive priority

High

Recommended defensive actions

• Apply the official patch to update the bt_hci_bee_send() function to follow the bt_hci_driver_api buffer-ownership contract.
• Implement additional monitoring to detect potential exploitation attempts.
• Review and update Bluetooth HCI driver configurations to ensure secure communication.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was introduced in the Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send(). The pre-fix code routed all error paths through a shared cleanup label that unconditionally called net_buf_unref(buf) before returning the error code. This leads to a double-free corruption of the host net_buf pool and potential crashes. The issue can be triggered by a remote Bluetooth peer driving heavy host transmit activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.