---
id: "CVE-2026-90832"
page: "https://infrastack.ai/live/CVE-2026-90832"
kind: "vulnerability"
aliases: ["CVE-2026-90832"]
title: "Zephyr Bluetooth: periodic advertising report over-reads adjacent HCI memory into apps"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["bluetooth", "embedded", "le-audio", "runtime", "zephyr"]
not_affected_if: ["buf-size-zero", "in-image-controller", "per-adv-sync-disabled"]
published_at: "2026-11-10T22:21:14+00:00"
first_seen_at: "2026-11-10T22:27:31+00:00"
updated_at: "2026-11-10T22:31:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90832", "first_seen_at": "2026-11-10T22:27:31+00:00"}]
exploit_sources: []
---

# Zephyr Bluetooth: periodic advertising report over-reads adjacent HCI memory into apps

Link for people: https://infrastack.ai/live/CVE-2026-90832 (this .md is for agents)

Zephyr's Bluetooth host copies more bytes than a periodic advertising report actually contains when reassembling fragmented data, reading past the event payload. A malicious or compromised Bluetooth controller on a split host/controller build can make that stale adjacent memory reach application callbacks, where it may be forwarded off-device.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the build uses a separate Bluetooth controller (H4 UART, SPI, USB or IPC) rather than Zephyr's in-image controller.
- Check whether `CONFIG_BT_PER_ADV_SYNC` is enabled and `CONFIG_BT_PER_ADV_SYNC_BUF_SIZE` is greater than `0`.
- Check the Zephyr version in use against the fixed release in the advisory.

## Timeline

- 2026-11-10T22:27:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90832

## Documents

- [advisory] Vendor advisory: github.com https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2q4q-gv2c-997j
- [fix] Patch: github.com https://github.com/zephyrproject-rtos/zephyr/commit/e9c3252c244b094b9caf6f426ffb77c509e58a9f

## From the sources

bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _v2) event. It verified that the fixed event header was present and that the controller-declared Data_Length fits the tailroom of the periodic-sync reassembly buffer, but never checked that the event actually carried as many data bytes as evt->length claims. Both reassembly paths — DATA_STATUS_PARTIAL, and DATA_STATUS_COMPLETE while a chain is already in progress — then called net_buf_simple_add_mem(&per_adv_sync->reassembly, buf->data, evt->length), copying up to 255 bytes starting past the end of the event's real payload.

The Data_Length field originates in the HCI controller, so the flaw is reachable in host-only/split builds where the controller is a separate part reached over H4 UART, SPI, USB or an inter-core IPC transport: a malicious, compromised or buggy controller (or an attacker able to inject on that link) can send a report declaring a length larger than the event payload. The generic event dispatcher in subsys/bluetooth/host/hci_core.c only enforces a per-event minimum length and never cross-checks the subevent's internal length field, so nothing else catches it. Builds using Zephyr's own in-image controller are not affected, because the controller always emits a length matching the bytes it appends.

Exploitation additionally requires CONFIG_BT_PER_ADV_SYNC with CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0 (the option defaults to 0, which compiles the reassembly block out; LE Audio broadcast-sink and Public Broadcast Profile applications that reassemble fragmented periodic advertising data set it), and an established periodic advertising sync.

The consequence is an out-of-bounds read of adjacent HCI RX-pool memory — including stale contents of previously received HCI events — which is copied into the reassembly buffer and then delivered to every registered bt_le_per_adv_sync_cb.recv listener as if it were received advertising data, so the disclosed memory becomes application-visible and may be forwarded off-device. The write side remains in bounds because the tailroom check uses the same length value, so there is no memory corruption; impact is limited to information disclosure and undefined behaviour on the over-read. The fix drops any report whose declared length exceeds the remaining event payload, matching the guard already present in the extended and legacy advertising report handlers.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_