Description

The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api buffer-ownership contract. That contract requires the driver to consume (unref) the transmit net_buf only on success; on an error return the host caller retains ownership and unrefs the buffer itself. The pre-fix code routed all error paths through a shared cleanup label that unconditionally called net_buf_unref(buf) before returning the error code. Because the host TX paths (in subsys/bluetooth/host/hci_core.c) unref the buffer again after send() returns an error, the buffer is freed twice: the driver returns it to its net_buf pool and the host then unrefs the already-freed buffer, corrupting the shared pool / underflowing the reference count (CWE-415). The same error branch additionally dereferenced buf->len inside a LOG_ERR call after the buffer had already been unref'd, a read of freed memory (CWE-416) that is compiled in at the default error log level. The failing edges are reached when the controller's host-to-controller buffer allocation fails or the controller send fails (resource-exhaustion / IO conditions). A remote Bluetooth peer can push the device toward these conditions indirectly by driving heavy host transmit activity, at which point the double-free corrupts the host net_buf pool and most likely crashes the device, with residual potential for further memory corruption. The impact is confined to builds using this specific Realtek BEE HCI driver. The fix returns early from each error path without unreffing and unrefs the buffer only on the success path, restoring the ownership contract and eliminating both the double-free and the use-after-free read.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-11T06:17:11.820Z",
  "pubdate": "2026-08-11T06:17:11.820Z",
  "executiveSummary": "A buffer-ownership contract violation exists in the Realtek BEE Bluetooth HCI driver, specifically within the bt_hci_bee_send() function located in drivers/bluetooth/hci/hci_bee.c. This flaw leads to a double-free (CWE-415) and a use-after-free read (CWE-416). The impact is primarily a denial of service via system crash due to heap corruption, with potential for further memory corruption within the shared net_buf pool. Affected systems are limited to builds utilizing the specific Realtek BEE HCI driver. An attacker can indirectly trigger the vulnerability by driving heavy host transmit activity to induce resource exhaustion or controller send failures. No authentication or special privileges are required, as the conditions are reached remotely via Bluetooth peer interactions driving heavy traffic.",
  "technicalDetails": "The vulnerability resides in the Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() within drivers/bluetooth/hci/hci_bee.c. The bt_hci_driver_api buffer-ownership contract dictates that the driver must only consume and unref the transmit net_buf on a successful operation. If an error is returned, the host caller retains ownership of the buffer and is responsible for unreffing it.\nPrior to the fix, the driver implemented a shared cleanup label across all error paths that unconditionally invoked net_buf_unref(buf) prior to returning an error code. Because the host TX paths in subsys/bluetooth/host/hci_core.c also execute net_buf_unref() upon receiving an error return from send(), the buffer is subjected to a double-free condition. This corrupts the shared net_buf pool and underflows the reference count.\nFurthermore, the identical error branch introduced a use-after-free read (CWE-416) by subsequently dereferencing buf->len inside a LOG_ERR invocation after the buffer had already been unreffed. This is compiled into default error logging configurations.\nThe attack flow proceeds as follows: A remote Bluetooth peer initiates heavy host transmit activity, driving the device toward resource-exhaustion or input/output failure conditions. When controller-to-host buffer allocation fails or the controller send operation errors out, the failing execution edges of bt_hci_bee_send() are reached. The driver incorrectly frees the net_buf and attempts to read its length, followed by the host caller freeing the same buffer a second time. This sequence corrupts the net_buf pool, typically resulting in a device crash and leaving residual potential for arbitrary memory corruption."
}