CVE-2026-79982 zephyrproject CVE debrief

Who should care

Organizations using the Zephyr project with Bluetooth HCI USB transport enabled should assess their exposure and apply the patch. This includes developers and administrators responsible for maintaining and securing Zephyr-based systems.

Why it matters

The CVE-2026-79982 vulnerability in the Zephyr project's Bluetooth HCI USB transport class allows remote attackers to cause a denial of service or potentially execute arbitrary code. Organizations using Zephyr with Bluetooth HCI USB transport enabled should assess their exposure, apply the patch, and verify system configuration to prevent potential exploitation.

• Remote code execution on affected systems
• Denial of service through buffer overflow
• Potential for attacker-controlled memory corruption
• Need for verification of patch application and system configuration

Technical summary

The Bluetooth HCI USB transport class in the Zephyr project has a buffer overflow vulnerability. The bt_hci_tx_sync_in function allocates a buffer from a fixed pool and copies HCI packets into it without checking the length. This allows remote attackers to cause a denial of service or potentially execute arbitrary code. The vulnerability is caused by a buffer overflow in the bt_hci_tx_sync_in function, which copies HCI packets into a USB transfer buffer without checking the length. The affected product is the Zephyr project with Bluetooth HCI USB transport enabled. The vulnerability has a high defensive priority and requires immediate attention.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch from the Zephyr project repository
• Update the Zephyr project to use the fixed bt_hci_tx_pool
• Verify the Bluetooth HCI USB transport configuration
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the Bluetooth HCI USB transport buffer overflow vulnerability. The vulnerability allows remote attackers to cause a denial of service or potentially execute arbitrary code due to a buffer overflow in the bt_hci_tx_sync_in function.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.