Buffer Ownership Violation in Realtek BEE Bluetooth Driver

CVE-2026-11894

What is CVE-2026-11894?

A critical vulnerability exists in the Realtek BEE Bluetooth HCI driver caused by a violation of the buffer ownership contract within the driver’s send callback function. If an error occurs during the transmission process, the driver improperly frees the net_buf, leading to potential double-free errors and memory corruption. This situation may arise when encountering resource exhaustion or I/O conditions during Bluetooth communication, pushing the host to handle heavy transmit loads. A remote Bluetooth device could indirectly force the host into these error states, causing a crash and creating residual risks of memory corruption. The fix ensures that buffers are only released on successful operations, thus maintaining the integrity of memory and preventing misuse.

References