Description

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, violates the bt_hci_driver_api.send() buffer-ownership contract. That contract (documented at include/zephyr/drivers/bluetooth.h) requires the buffer reference to be consumed only on success; on error the caller still owns the reference and unrefs it. The driver instead routed all error paths through a shared label that unconditionally called net_buf_unref(buf) before returning the error code, consuming the buffer on failure as well. When send() returns an error, the host TX path (send_buf() in subsys/bluetooth/host/conn.c) unrefs the same buffer again, believing it still owns it. This double-unref over-decrements the net_buf reference count. Because the buffer is a TX fragment whose destroy callback also decrements its still-queued parent buffer, the parent is freed prematurely while reachable on the connection TX queue, producing a use-after-free and corruption of the shared net_buf pool rather than a benign leak. The error conditions are on the host-to-controller transmit path (controller send failure, or an unsupported H:4 packet type), so they are not driven directly by attacker-supplied radio bytes; a remote/adjacent peer can influence them only indirectly, e.g. by inducing controller TX failures under heavy link load. The consequence when reached is BLE-stack denial of service (crash / pool corruption) with possible further memory corruption, bounded to devices using one of these Bouffalo Lab on-chip controllers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-11T05:17:11.567Z",
  "pubdate": "2026-08-11T05:17:11.567Z",
  "executiveSummary": "A buffer-ownership contract violation exists in the Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers, specifically within the bt_bflb_send() function located in drivers/bluetooth/hci/hci_bflb.c.\nThe vulnerability manifests as a double-unref condition of network buffers (net_buf) during error paths in the host-to-controller transmit path.\nWhen the send operation fails, the driver unconditionally decrements the buffer reference count, violating the bt_hci_driver_api.send() contract which dictates that the caller retains ownership and unrefs the buffer upon error.\nSubsequent handling by the host TX path in subsys/bluetooth/host/conn.c unrefs the same buffer a second time, leading to a reference count over-decrement.\nBecause the affected buffers are TX fragments whose destroy callbacks decrement still-queued parent buffers, the parent buffer is freed prematurely while remaining reachable on the connection TX queue.\nThis induces a use-after-free condition, resulting in shared net_buf pool corruption, denial of service via system crashes, and potential arbitrary memory corruption.\nThe vulnerability affects devices utilizing Bouffalo Lab BL60x, BL70x, and BL61x on-chip BLE controllers.\nExploitation is indirect, requiring conditions that induce controller send failures or unsupported packet types, such as heavy link loads, limiting direct remote exploitation but posing significant local reliability risks.",
  "technicalDetails": "The root cause of the vulnerability is a violation of the API buffer-ownership contract defined by bt_hci_driver_api.send() in include/zephyr/drivers/bluetooth.h.\nThe contract explicitly specifies that buffer references must be consumed by the driver only upon a successful transmission; if an error occurs, the caller retains ownership of the reference and is responsible for calling net_buf_unref().\nIn the vulnerable function bt_bflb_send() within drivers/bluetooth/hci/hci_bflb.c, all error paths are routed through a shared cleanup label that unconditionally invokes net_buf_unref(buf) before returning the error code.\nConsequently, when an error condition is triggered—such as a controller send failure or the reception of an unsupported H:4 packet type on the host-to-controller transmit path—the driver consumes the buffer reference despite failing.\nFollowing the return of the error code, the host TX path (implemented via send_buf() in subsys/bluetooth/host/conn.c) attempts to clean up its tracking by invoking net_buf_unref() on the same buffer, operating under the valid assumption that it still retains ownership.\nThis sequence produces a double-unref, causing an over-decrement of the net_buf reference count.\nBecause the buffers involved are TX fragments, their associated destroy callbacks decrement the reference counts of their still-queued parent buffers.\nThe premature underflow of the parent buffer's reference count causes the parent to be freed while it is still actively queued and reachable on the connection TX queue.\nSubsequent memory accesses to this freed parent buffer trigger a use-after-free vulnerability, corrupting the shared net_buf memory pool.\nRegarding attack flow, an adjacent or remote peer cannot directly trigger this vulnerability via arbitrary radio bytes, as the error conditions are restricted to the host-to-controller transmit path.\nHowever, an attacker can indirectly influence the execution flow by inducing heavy link loads or forcing conditions that cause controller TX failures or transmit unsupported packet formats.\nNo specific authentication or privileges are required beyond the ability to interact with the affected BLE stack and induce transmission error states.\nThe post-exploitation impact is strictly bounded to devices integrating Bouffalo Lab BL60x, BL70x, or BL61x on-chip controllers, leading to predictable denial of service through stack crashes and potential memory corruption."
}