{"id":"CVE-2026-78117","kind":"vulnerability","aliases":["CVE-2026-78117"],"related":[],"title":"Zephyr Infineon PSOC 6 Bluetooth driver races, can leak adjacent RAM to peers","description":"The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cy_stc_ble_hci_tx_packet_info_t hci_tx_pkt. psoc6_bless_send() cleared and populated that descriptor's packetType, dataLength and data fields before acquiring psoc6_bless_operation_sem, so the driver's serialising semaphore protected only the call into Cy_BLE_SoftHciSendAppPkt() and not the shared state that call reads.\n\nThe Bluetooth host does not guarantee a single HCI sender. Most transmissions are funnelled through the cooperative TX-processor work queue, but bt_hci_cmd_send() deliberately bypasses bt_dev.cmd_tx_queue for BT_HCI_OP_HOST_NUM_COMPLETED_PACKETS and calls bt_send() directly from the caller's thread; that caller is bt_hci_host_num_completed_packets(), the acl_in_pool destroy callback, which runs on whichever thread drops the last reference to a received ACL buffer. CONFIG_BT_HCI_ACL_FLOW_CONTROL defaults to y on this driver's boards, and an application that returns -EINPROGRESS from its L2CAP recv callback and later calls bt_l2cap_chan_recv_complete() performs that unref from its own preemptible thread. A remote peer that generates Bluetooth traffic concurrently with the device's own transmissions raises the collision rate.\n\nWhen two senders interleave, the semaphore holder can hand the controller a descriptor whose dataLength comes from one net_buf and whose data pointer comes from another — or one whose buffer has already been returned to its pool. The controller then copies and transmits up to a full HCI/ACL payload starting at a shorter or recycled buffer, disclosing adjacent RAM contents to the connected peer; other interleavings duplicate one HCI packet and silently drop another, disrupting the link. The driver only reads through the shared descriptor, so no memory corruption or write primitive results, and the disclosed bytes are not attacker-chosen. The fix makes the descriptor a local variable in psoc6_bless_send(), removing the shared state; Cy_BLE_SoftHciSendAppPkt() copies the packet before returning, so it need not outlive the call.","summary":"The Infineon PSOC 6 BLESS HCI driver shares one outgoing packet descriptor between threads, so concurrent Bluetooth transmissions can mix buffer pointers and lengths. A connected remote peer can receive up to a full ACL payload of adjacent RAM contents, and duplicated or dropped HCI packets can disrupt the link.","severity":"medium","cvss":4.2,"epss":0.00125,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","embedded","infineon-psoc6","runtime","zephyr"],"not_affected_if":["no-psoc6-bless-driver"],"how_to_check":"- Check whether the device runs Bluetooth with the Infineon PSOC 6 BLESS HCI driver (drivers/bluetooth/hci/hci_infineon_psoc6_bless.c) and whether `CONFIG_BT_HCI_ACL_FLOW_CONTROL` is enabled.\n- Check whether the application returns -EINPROGRESS from its L2CAP recv callback and later calls `bt_l2cap_chan_recv_complete()` from a preemptible thread.","fix":"- Move the Zephyr tree to a release that includes the fix making the packet descriptor a local variable in `psoc6_bless_send()`; the exact version is unknown from the sources.\n- Until patched, unknown whether disabling `CONFIG_BT_HCI_ACL_FLOW_CONTROL` or serialising the unref path is a sufficient workaround; the sources do not say.","status":"open","published_at":"2026-10-21T19:17:03+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:41:30+00:00","updated_at":"2026-10-25T04:41:30+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:41:30Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Zephyr tree to a release that includes the fix making the packet descriptor a local variable in `psoc6_bless_send()`; the exact version is unknown from the sources.\n- Until patched, unknown whether disabling `CONFIG_BT_HCI_ACL_FLOW_CONTROL` or serialising the unref path is a sufficient workaround; the sources do not say.","reach":"network","title":"Zephyr Infineon PSOC 6 Bluetooth driver races, can leak adjacent RAM to peers","impact":"medium","summary":"The Infineon PSOC 6 BLESS HCI driver shares one outgoing packet descriptor between threads, so concurrent Bluetooth transmissions can mix buffer pointers and lengths. A connected remote peer can receive up to a full ACL payload of adjacent RAM contents, and duplicated or dropped HCI packets can disrupt the link.","category":"runtime","nicknames":[],"who_cares":["zephyr","embedded","bluetooth","infineon-psoc6"],"confidence":0.6,"needs_auth":"no","worst_case":"Adjacent RAM contents disclosed to a connected Bluetooth peer","analyst_note":"Confirm fixed Zephyr version and whether ACL flow control default and workaround are documented in the NVD or upstream advisory.","how_to_check":"- Check whether the device runs Bluetooth with the Infineon PSOC 6 BLESS HCI driver (drivers/bluetooth/hci/hci_infineon_psoc6_bless.c) and whether `CONFIG_BT_HCI_ACL_FLOW_CONTROL` is enabled.\n- Check whether the application returns -EINPROGRESS from its L2CAP recv callback and later calls `bt_l2cap_chan_recv_complete()` from a preemptible thread.","needs_analyst":true,"not_affected_if":["no-psoc6-bless-driver"],"who_is_affected":"Devices built on Infineon PSOC 6 with the BLESS HCI driver and Bluetooth active, especially where ACL flow control is enabled and applications release received buffers from their own threads. Systems without this controller, or without concurrent Bluetooth traffic from their own threads, are less exposed. The sources do not describe further conditions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000825,"input_tokens":4105,"output_tokens":829,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-78117':16A,19A '6':4A,30B,80C 'acl':61B,212C,229C,234C 'acquir':125C 'adjac':10A,64B,348C 'alreadi':322C 'anoth':316C,364C 'applic':247C 'attack':391C 'attacker-chosen':390C 'ble':101C,142C,410C 'bless':31B,81C,111C,127C,403C 'bluetooth':5A,20B,43B,153C,277C 'board':244C 'bt':175C,185C,194C,205C,232C,259C 'bt_dev.cmd':181C 'buf':309C 'buffer':47B,230C,320C,346C 'bypass':180C 'byte':387C 'call':139C,150C,193C,258C,423C 'callback':216C,255C 'caller':199C,203C 'chan':261C 'chosen':392C 'clear':113C 'cmd':177C 'collis':288C 'come':305C,314C 'complet':190C,209C,263C 'concurr':42B,279C 'config':231C 'connect':52B,353C 'content':66B,350C 'control':236C,300C,329C 'cooper':168C 'copi':331C,412C 'corrupt':379C 'cve':14A,17A 'cy':99C,141C,409C 'data':122C,312C 'datalength':120C,304C 'default':237C 'deliber':179C 'descriptor':38B,91C,117C,302C,375C,397C 'destroy':215C 'devic':282C 'direct':196C 'disclos':347C,386C 'disrupt':74B,365C 'driver':6A,33B,83C,132C,242C,369C 'drivers/bluetooth/hci/hci_infineon_psoc6_bless.c':85C 'drop':70B,222C,363C 'duplic':68B,357C 'einprogress':250C 'embed':21B 'field':123C 'file':95C 'file-scop':94C 'fix':394C 'flow':235C 'full':60B,337C 'funnel':165C 'generat':276C 'guarante':157C 'hand':298C 'hci':32B,71B,82C,89C,102C,107C,160C,176C,186C,206C,233C,359C 'hci/acl':338C 'holder':296C 'host':154C,188C,207C 'infineon':2A,23B,28B,78C 'infineon-psoc6':22B 'info':105C 'interleav':293C,356C 'l2cap':253C,260C 'last':224C 'later':257C 'leak':9A 'length':50B 'link':76B,367C 'local':399C 'make':395C 'memori':378C 'mix':46B 'need':419C 'net':308C 'num':189C,208C 'one':35B,307C,318C,358C 'op':187C 'oper':128C 'outgo':36B,88C 'outliv':421C 'packet':37B,72B,90C,104C,191C,210C,360C,414C 'packettyp':119C 'payload':62B,339C 'peer':13A,54B,274C,354C 'perform':264C 'pkt':109C 'pointer':48B,313C 'pool':214C,327C 'popul':115C 'preemptibl':270C 'primit':382C 'processor':171C 'protect':136C 'psoc':3A,29B,79C 'psoc6':24B,110C,126C,402C 'queue':173C,183C 'race':7A 'rais':286C 'ram':11A,65B,349C 'rate':289C 'read':151C,371C 'receiv':56B,228C 'recv':254C,262C 'recycl':345C 'refer':225C 'remot':53B,273C 'remov':405C 'result':383C 'return':249C,324C,416C 'run':218C 'runtim':25B 'scope':96C 'sem':129C 'semaphor':135C,295C 'send':112C,178C,195C,404C 'sender':161C,292C 'serialis':134C 'share':34B,147C,374C,407C 'shorter':343C 'silent':362C 'singl':159C 'softhcisendapppkt':143C,411C 'start':340C 'state':148C,408C 'static':98C 'stc':100C 'store':86C 'thread':40B,201C,221C,271C 'traffic':278C 'transmiss':44B,163C,285C 'transmit':333C 'two':291C 'tx':103C,108C,170C,182C 'tx-processor':169C 'unref':266C 'variabl':97C,400C 'whichev':220C 'whose':303C,311C,319C 'work':172C 'write':381C 'y':239C 'zephyr':1A,26B","nicknames":[],"mitigations":[],"who_affected":"Devices built on Infineon PSOC 6 with the BLESS HCI driver and Bluetooth active, especially where ACL flow control is enabled and applications release received buffers from their own threads. Systems without this controller, or without concurrent Bluetooth traffic from their own threads, are less exposed. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T19:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78117","severity":null,"published_at":"2026-10-21T19:17:03+00:00","modified_at":"2026-10-23T22:17:00+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-78117","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78117","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}