{"id":"CVE-2026-79982","kind":"vulnerability","aliases":["CVE-2026-79982"],"related":[],"title":"Zephyr USB Bluetooth HCI class: buffer overflow lets nearby attacker corrupt memory","description":"The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that buffer from bt_hci_ep_pool, a fixed pool whose slots are only USBD_MAX_BULK_MPS bytes (64 on full-speed-only builds), and then performed net_buf_add_mem(buf, bt_buf->data, bt_buf->len) with no length check. HCI event and ACL buffers are sized by CONFIG_BT_BUF_EVT_RX_SIZE and CONFIG_BT_BUF_ACL_RX_SIZE and can be far larger, so the copy runs past the end of the 64-byte slot into the adjacent slots and into whatever follows the statically allocated pool.\n\nThe device runs the local Bluetooth controller in raw HCI mode (CONFIG_BT_HCI_RAW), so the oversized packets originate over the air. With the HCI buffer sizes recommended for full-featured controllers, an unauthenticated attacker within Bluetooth range can supply the overflowing bytes: a connected peer that negotiates Data Length Extension can send ACL fragments up to CONFIG_BT_CTLR_DATA_LENGTH_MAX bytes, and an attacker that merely broadcasts extended advertising data reaches the same path through LE Extended Advertising Report events, which the controller fragments only to CONFIG_BT_BUF_EVT_RX_SIZE. In the stock configuration the overflow is already reached without any radio traffic: the mandatory Read Supported Commands command-complete event is 70 bytes and overruns the 64-byte slot by six bytes on every host initialization.\n\nBecause net_buf_add_mem() validates tailroom only through an assertion unless CONFIG_NET_BUF_HARDENING is enabled, builds with CONFIG_ASSERT=n — the usual production setting — silently corrupt memory adjacent to the USB buffer pool with attacker-chosen contents, which on a target without memory protection between subsystems can lead to arbitrary code execution. Builds with assertions enabled fail the assertion instead and panic, giving a remotely triggerable denial of service. The fix introduces a separate bt_hci_tx_pool sized to MAX(BT_BUF_ACL_RX_SIZE, BT_BUF_EVT_RX_SIZE) for the controller-to-host direction while leaving the host-to-device pool at the endpoint packet size, which is already bounds-checked during reassembly.","summary":"Zephyr's USB Bluetooth HCI class (device_next) copies controller-to-host HCI packets into 64-byte USB slots on full-speed-only builds with no length check. The default build already overruns by 6 bytes at host init (70-byte Read Supported Commands event). A nearby unauthenticated attacker can send larger ACL packets or extended advertising reports. With CONFIG_ASSERT=n the result is memory corruption and possibly code execution. With assertions on it is a panic (DoS). Over-the-air LE triggers apply to full-speed-only builds from v4.2.0; before that, or on high-speed builds, reaching it needs an external BR/EDR controller and BT_BUF_ACL_RX_SIZE >= 508.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"zephyr","fixed":["4.5.0"],"affected":">= 3.3.0, <= 4.4.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["bluetooth","embedded","raw-hci","runtime","usb","zephyr"],"not_affected_if":["bt-hci-raw-disabled","legacy-usb-stack","no-usb-hci-transport"],"how_to_check":"You are exposed if your build uses the device_next USB stack with the Bluetooth HCI USB class (subsys/usb/device_next/class/bt_hci.c, CONFIG_BT_HCI_RAW over USB) on Zephyr 3.3.0 to 4.4.2. Check 'git describe' of your Zephyr tree and your .config / build config for CONFIG_USBD_BT_HCI and CONFIG_BT_HCI_RAW. Most exposed: full-speed-only USB (USBD_MAX_BULK_MPS = 64) on v4.2.0 or later. Not affected: the legacy USB stack, and builds without the USB HCI class.","fix":"Move to Zephyr 4.5.0 once released (advisory's projected version; confirm). Until then, cherry-pick commit 0419defd2391 (main) or take the backports on v4.4-branch (PR #117504) / v4.3-branch (PR #117505). Fix: separate bt_hci_tx_pool sized MAX(BT_BUF_ACL_RX_SIZE, BT_BUF_EVT_RX_SIZE). Workaround: do not expose the controller through the USB HCI class (disable it). CONFIG_NET_BUF_HARDENING=y is not an advisory-endorsed mitigation: it only turns the tailroom check from assert-only into a real check, which would fault instead of corrupting memory, and the default build trips it at host init.","status":"open","published_at":"2026-10-23T20:17:28+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:30:58+00:00","updated_at":"2026-10-23T23:34:23+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T22:30:58Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to a Zephyr release containing the separate bt_hci_tx_pool fix in subsys/usb/device_next/class/bt_hci.c; unknown which release contains it.\nUntil then, disable CONFIG_BT_HCI_RAW on USB HCI builds or rebuild with CONFIG_NET_BUF_HARDENING=y (unconfirmed by sources).","reach":"network","title":"Zephyr USB Bluetooth HCI class: buffer overflow lets nearby attacker corrupt memory","impact":"high","summary":"Zephyr's USB Bluetooth HCI transport copies controller packets into 64-byte USB buffers with no length check, so larger packets overflow into adjacent memory. A nearby attacker over Bluetooth can trigger it, and with assertions disabled this can lead to code execution, while with assertions enabled it causes a crash.","category":"runtime","who_cares":["zephyr","bluetooth","usb","embedded","raw-hci"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker corrupts adjacent memory and may run code on the device","analyst_note":"Confirm the fixed Zephyr release version and whether CONFIG_NET_BUF_HARDENING is a valid mitigation, from the NVD entry and the Zephyr advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-usb-hci-transport","bt-hci-raw-disabled"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":3750,"output_tokens":552,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed Zephyr release version and whether CONFIG_NET_BUF_HARDENING is a valid mitigation, from the NVD entry and the Zephyr advisory.","search":"'-2026':14A,17A '-79982':15A,18A '508':145B '6':64B '64':44B,203C,263C,403C '70':69B,398C 'acl':82B,142B,231C,246C,333C,500C 'add':215C,416C 'adjac':268C,443C 'advertis':86B,351C,360C 'air':112B,300C 'alloc':183C,276C 'alreadi':61B,382C,530C 'appli':115B 'arbitrari':466C 'assert':90B,102B,423C,434C,471C,475C 'attack':10A,78B,314C,346C,451C 'attacker-chosen':450C 'bluetooth':3A,20B,31B,147C,283C,316C 'bound':532C 'bounds-check':531C 'br/edr':137B 'broadcast':349C 'bt':140B,178C,187C,218C,221C,237C,244C,290C,338C,370C,491C,498C,503C 'buf':141B,214C,217C,219C,222C,238C,245C,371C,415C,427C,499C,504C 'buffer':6A,171C,185C,232C,304C,447C 'build':53B,60B,121B,131B,209C,431C,469C 'bulk':200C 'byte':45B,65B,70B,202C,264C,322C,343C,399C,404C,408C 'check':57B,227C,533C 'chosen':452C 'class':5A,33B,151C 'code':99B,467C 'command':73B,392C,394C 'command-complet':393C 'complet':395C 'config':89B,236C,243C,289C,337C,369C,425C,433C 'configur':378C 'connect':324C 'content':453C 'control':38B,138B,162C,284C,311C,365C,511C 'controller-to-host':37B,161C,510C 'copi':36B,159C,256C 'corrupt':11A,96B,441C 'ctlr':339C 'cve':13A,16A 'data':220C,328C,340C,352C 'default':59B 'denial':483C 'devic':34B,156C,279C,521C 'direct':514C 'dos':108B 'embed':21B 'enabl':430C,472C 'end':260C 'endpoint':177C,525C 'enqueu':173C 'ep':189C 'event':74B,229C,362C,396C 'everi':160C,410C 'evt':239C,372C,505C 'execut':100B,468C 'extend':85B,350C,359C 'extens':330C 'extern':136B 'fail':473C 'far':252C 'featur':310C 'fix':192C,487C 'follow':273C 'fragment':334C,366C 'full':50B,118B,206C,309C 'full-featur':308C 'full-speed-on':49B,117B,205C 'give':479C 'harden':428C 'hci':4A,24B,32B,41B,148C,165C,179C,188C,228C,287C,291C,303C,492C 'high':129B 'high-spe':128B 'host':40B,67B,164C,411C,513C,519C 'host-to-devic':518C 'init':68B 'initi':412C 'instead':476C 'introduc':488C 'larger':81B,253C 'le':113B,358C 'lead':464C 'leav':516C 'len':223C 'length':56B,226C,329C,341C 'let':8A 'local':282C 'mandatori':389C 'max':199C,342C,497C 'mem':216C,417C 'memori':12A,95B,442C,459C 'mere':348C 'mode':288C 'mps':201C 'n':91B,435C 'nearbi':9A,76B 'need':134B 'negoti':327C 'net':213C,414C,426C 'new':154C 'next':35B 'origin':297C 'over-the-air':109B 'overflow':7A,321C,380C 'overrun':62B,401C 'overs':295C 'packet':42B,83B,166C,296C,526C 'panic':107B,478C 'past':258C 'path':356C 'peer':325C 'perform':212C 'pool':190C,193C,277C,448C,494C,522C 'possibl':98B 'product':438C 'protect':460C 'radio':386C 'rang':317C 'raw':23B,286C,292C 'raw-hci':22B 'reach':132B,353C,383C 'read':71B,390C 'reassembl':535C 'recommend':306C 'remot':481C 'report':87B,361C 'result':93B 'run':257C,280C 'runtim':25B 'rx':143B,240C,247C,373C,501C,506C 'send':80B,332C 'separ':490C 'servic':485C 'set':439C 'silent':440C 'six':407C 'size':144B,234C,241C,248C,305C,374C,495C,502C,507C,527C 'slot':47B,195C,265C,269C,405C 'speed':51B,119B,130B,207C 'stack':157C 'static':275C 'stock':377C 'subsys/usb/device_next/class/bt_hci.c':158C 'subsystem':462C 'suppli':319C 'support':72B,391C 'sync':181C 'tailroom':419C 'target':457C 'traffic':387C 'transfer':170C 'transport':150C 'trigger':114B,482C 'tx':180C,493C 'unauthent':77B,313C 'unless':424C 'usb':2A,26B,30B,46B,149C,155C,169C,446C 'usbd':198C 'usual':437C 'v4.2.0':123B 'valid':418C 'whatev':272C 'whose':194C 'within':315C 'without':384C,458C 'zephyr':1A,19A,27B,28B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T20:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79982","severity":null,"published_at":"2026-10-23T20:17:28+00:00","modified_at":"2026-10-23T20:17:28+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79982:471","url":null,"severity":null,"published_at":"2026-10-23T23:34:23+00:00","modified_at":"2026-10-23T23:34:23+00:00","first_seen_at":"2026-10-23T23:34:23+00:00","fetched_at":"2026-10-23T23:34:23+00:00","note":"Read Zephyr GHSA-w5px-w97v-c3hj and fix commit 0419def. Affected >=3.3.0 <=4.4.2, patched 4.5.0 (projected, not yet released; backports merged to v4.4-branch #117504 and v4.3-branch #117505). No exploitation or PoC found; no social search (embargo lifted today). CONFIG_NET_BUF_HARDENING is not named as a mitigation by the advisory; it only says add_mem asserts on tailroom unless it is set."}],"documents":[{"id":2050,"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w5px-w97v-c3hj","title":"GHSA-w5px-w97v-c3hj: OOB write in USB Bluetooth HCI class","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2052,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/0419defd2391652edc27689d206fcd9c48439d4a","title":"0419def usb: device_next: bt_hci: size buffers for complete HCI packets","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2053,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79982","title":"NVD CVE-2026-79982","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}