Buffer Management Issue in Bluetooth Driver for Bouffalo Lab BLE Controllers

CVE-2026-11893

What is CVE-2026-11893?

The Bluetooth HCI driver for Bouffalo Lab's BLE controllers exhibits a buffer management flaw in the bt_bflb_send() function. This issue arises from a violation of the buffer-ownership contract established within the bt_hci_driver_api.send() specification. The driver erroneously frees the buffer on error scenarios, leading to a double-unreference scenario that corrupts the net_buf reference count. When transmit operations encounter errors, the host mistakenly assumes ownership of the buffer, resulting in the premature destruction of necessary data structures and subsequent memory corruption. This defect can be triggered indirectly by external factors, potentially causing Denial of Service through crashes or corruption of the Bluetooth stack, impacting devices leveraging the affected Bouffalo Lab controllers.

References