CVE-2026-11894

Executive Summary

CVE-2026-11894 is a memory-safety defect in the Realtek BEE Bluetooth HCI driver used in Zephyr RTOS builds. The send callback bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c violates the bt_hci_driver_api buffer-ownership contract by unreferencing the transmit net_buf on error paths, leading to a double-free (CWE-415) and a subsequent use-after-free (CWE-416) in an error log statement. A remote Bluetooth peer can indirectly trigger the failing error paths through heavy host transmit activity, corrupting the host net_buf pool and most likely crashing the device; residual potential for further memory corruption exists. The CVSS v3.1 score is 5.9 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H), reflecting an adjacent-adjacent attack surface with high availability impact and no public exploit code reported.

Technical Analysis

The vulnerability is a contract violation inside the Realtek BEE Bluetooth HCI driver's send callback in Zephyr's Bluetooth stack. The bt_hci_driver_api protocol requires that a driver consuming a transmit buffer via the net_buf reference-counting system only release ownership of that buffer (via net_buf_unref) on a successful return. When a send operation returns an error, ownership remains with the host caller, which is responsible for releasing the buffer. The pre-fix implementation of bt_hci_bee_send() routed all error paths through a shared cleanup label that unconditionally called net_buf_unref(buf) before returning the error code. Consequently, on any error return the driver surrendered a reference that it was never granted.

The host-side transmit paths in subsys/bluetooth/host/hci_core.c follow the documented contract: after send() returns an error, they unref the buffer a second time. The combined behavior produces a double-free (CWE-415): the driver returns the buffer to its net_buf pool and the host subsequently unrefs the already-freed buffer. This corrupts the shared buffer pool and underflows the buffer's reference count, both of which can destabilize the allocator and lead to memory corruption. In the same error branch, the code also dereferences buf->len inside a LOG_ERR call after the buffer has already been unref'd — a read of freed memory (CWE-416) that is compiled in at the default error log level.

The failing edges are triggered when the controller's host-to-controller buffer allocation fails or the controller send itself fails — i.e., resource-exhaustion or I/O conditions. These conditions are not directly attacker-controlled, but a remote Bluetooth peer can push the device toward them by driving heavy host transmit activity, exhausting the buffer pool and increasing the probability that an allocation or send error occurs. The nature of the flaw class (memory-pool double-free) means that the immediate, most reliable consequence is a host crash; the NVD description also notes residual potential for further memory corruption.

Impact is confined to builds using this specific driver (Realtek BEE HCI over Zephyr), and insufficient technical detail is available to enumerate the exact affected Zephyr versions or controller part numbers beyond the function and file names given. No functional details of the controller's firmware interface are disclosed, so analysis above is limited to the host-stack mechanics described in the NVD entry.

Exploitation Scenarios

No public PoC or exploit code is reported, and no in-the-wild exploitation evidence exists (CISA KEV: NO; EPSS 0.00170). The attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker must identify a Bluetooth-enabled device whose firmware is a Zephyr build incorporating the Realtek BEE HCI driver. This can be accomplished via Bluetooth advertising/inquiry data, device appearance characteristics typical of embedded IoT products, or physical/board-level identification. The target must be within Bluetooth range (matching the CVSS AV:A / adjacent-adjacent vector).

2. Triggering the flaw. The attacker establishes a Bluetooth connection (classic or low-energy, whichever the target supports) and drives heavy transmit activity to and from the target. By saturating the host-to-controller path, the attacker increases the likelihood that a host-to-controller buffer allocation fails or a controller send fails. When the driver returns the associated error through the vulnerable cleanup path, the double-free occurs. This phase resembles a resource-exhaustion flood at the vulnerability-class level; per the CVSS factor AC:H, the attacker must hit specific error-return timing, so the trigger is probabilistic rather than deterministic.

3. Payload / execution method. There is no content-based payload in the conventional sense. The corruption is achieved purely by forcing the driver into its error branch; no specific packet contents or protocol fields are required or disclosed. The double-free on the shared net_buf pool corrupts allocator state (CWE-415), and the subsequent LOG_ERR dereference of buf->len reads freed memory (CWE-416). Any resulting code-execution path would depend on how the allocator corruption is shaped, which the available data does not demonstrate.

4. Post-exploitation impact. The expected outcome is a device crash or reboot loop, i.e., denial of service against the Bluetooth subsystem and potentially the whole device. CVSS indicates no confidentiality impact (C:N) and only low integrity impact (I:L), with high availability impact (A:H). The residual potential for further memory corruption means adjacent-range persistence or privilege escalation within the firmware cannot be ruled out, but it is not evidenced by the NVD description or any public research.

Because the trigger is a race/resource condition reachable from an adjacent position without authentication (PR:N, UI:N), this vulnerability is best characterized as an adjacent-range, remotely-stimulable denial-of-service primitive with an uncharacterized memory-corruption tail risk.

Impact Assessment

• CVSS v3.1: 5.9 — AV:A (adjacent — Bluetooth range), AC:H (requires specific buffer-exhaustion/error timing), PR:N (no privileges), UI:N (no user interaction), S:U (single system), C:N (no confidentiality loss), I:L (low integrity, allocator corruption), A:H (high availability impact, crash).
• Affected systems. Zephyr RTOS devices that build in the Realtek BEE Bluetooth HCI driver and that expose Bluetooth connectivity. The OSV record ties the vulnerability to the Zephyr source tree at commit 684c9e8f32e4373a21098559f748f06915f950c9 (unfixed state). Embedded consumer, industrial, and medical IoT devices using this controller/driver combination are in scope.
• Business impact. Primarily availability: an adjacent attacker can crash a device, causing downtime in unattended or hard-to-reach deployments, loss of telemetry, interruption of control functions, and increased field-repair / recall costs. The low integrity component could, in principle, contribute to a wider memory-corruption chain, though no such chain is demonstrated.
• Blast radius. Confined to a single device per exploitation attempt (S:U); no direct lateral movement is implied. However, dense IoT deployments (e.g., fleets of battery-powered sensors) could be disrupted one device at a time within radio range.
• Exploit intelligence. No public PoC, no Nuclei template, no exploit code, and no CISA KEV inclusion. EPSS places this at 0.00170 (6.7th percentile), reflecting a low near-term likelihood of exploitation.

Detection Guidance

Detection for this class of flaw is host-centric: the corruption manifests in kernel/RTOS logs, memory-management diagnostics, and crash artifacts rather than in distinct network packet signatures. Network-layer rules are therefore limited to the resource-exhaustion precursor. Rules below are realistic starting points and should be tuned to local telemetry.

Sigma Rule

title: Realtek BEE HCI Bluetooth Driver Double-Free / UAF Indication
id: 3f6c4a21-7d3e-4c8a-9b1e-2c5d8a0f7e44
status: experimental
description: >
  Detects kernel memory-management error messages associated with the vulnerable
  Realtek BEE Bluetooth HCI driver (bt_hci_bee_send) or net_buf double-unref
  conditions on Linux/Zephyr-derived host logs.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-11894
tags:
  - attack.t1203
  - cve.2026.11894
logsource:
  product: linux
  service: kernel
detection:
  selection_driver:
    message|contains:
      - "hci_bee"
      - "bt_hci_bee_send"
      - "net_buf_unref"
  selection_corruption:
    message|contains|all:
      - "hci_bee"
    message|contains:
      - "double free"
      - "refcount"
      - "KASAN"
      - "BUG:"
      - "use-after-free"
  condition: selection_driver and selection_corruption
  timeframe: 5m
level: high
falsepositives:
  - Benign development/debug builds with memory debugging enabled
  - Other Bluetooth drivers sharing net_buf error text

YARA Rule

rule cve_2026_11894_realtek_bee_hci_driver
{
    meta:
        author = "Threat Intelligence — vartersit.com"
        description = "Matches firmware images containing symbol/string artifacts of the vulnerable Realtek BEE Bluetooth HCI driver code (CVE-2026-11894)."
        cve = "CVE-2026-11894"
        cwe = "CWE-415"
        date = "2026-02-01"
    strings:
        $s1 = "bt_hci_bee_send" ascii
        $s2 = "hci_bee" ascii
        $s3 = "net_buf_unref" ascii
        $s4 = "bt_hci_driver_api" ascii
        $s5 = "subsys/bluetooth/host/hci_core.c" ascii
    condition:
        filesize > 2KB and 2 of ($s*) and uint16(0) in (0x7F45, 0x5044)
}

Suricata IDS Rule

Network monitoring limitation: Suricata does not natively parse classic Bluetooth HCI frames transported over UART/USB. The rule below flags the network-visible precursor — a sustained transmit flood from a single peer toward the device that would be used to exhaust host-to-controller buffers. This is an anomaly/rate rule rather than a content match.

alert ip any any -> any any (msg:"CVE-2026-11894 Realtek BEE BT HCI - possible buffer-exhaustion flood precursor"; flow:to_server; threshold: type both, track by_src_addr, count 2000, seconds 60; classtype:attempted-dos; reference:cve,2026-11894; sid:2026118940; rev:1;)

Tune the threshold to observed baseline Bluetooth-related traffic; the rule is intentionally conservative and will require per-deployment calibration.

Elastic Detection

sequence by host.id with maxspan=5m
  [ any where event.category == "kernel" and message like "*hci_bee*" ]
  [ any where event.category == "kernel" and
       (message like "*double free*" or
        message like "*refcount*underflow*" or
        message like "*use-after-free*") ]

This EQL sequence correlates an initial reference to the affected driver with a subsequent memory-corruption signature within five minutes on the same host, which is representative of the error-path sequence (driver error → double-unref → allocator complaint).

Splunk SPL Query

index=linux sourcetype=linux_kernel* OR sourcetype=syslog
  ("hci_bee" OR "bt_hci_bee_send" OR "net_buf")
  AND ("double free" OR "refcount" OR "use-after-free" OR "BUG:")
| stats count by host, source, _time
| sort - _time
| where count > 1
| eval severity=case(match(_raw, "(?i)double.?free|use.?after.?free"), "high", 1=1, "medium")

Wazuh OSSEC Rule

<group name="bluetooth,zephyr,">
  <rule id="100399" level="12" frequency="3" timeframe="120">
    <if_sid>550</if_sid>
    <match>hci_bee|bt_hci_bee_send</match>
    <regex>\b(double free|refcount|use-after-free|BUG:)\b</regex>
    <description>CVE-2026-11894: Realtek BEE Bluetooth HCI driver memory corruption indications (double-free / UAF).</description>
    <group>cve-2026-11894,</group>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>

  <rule id="100400" level="10" frequency="5" timeframe="300">
    <if_sid>550</if_sid>
    <match>hci_bee</match>
    <description>CVE-2026-11894: repeated Realtek BEE HCI driver error events — possible resource-exhaustion attempt.</description>
    <group>cve-2026-11894,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED — a single source, OSV, claims a patch, not independently confirmed). The OSV record ties the vulnerable code state to commit 684c9e8f32e4373a21098559f748f06915f950c9, which remains unfixed; a public vendor advisory from Realtek has not been issued. No workarounds are provided in the advisory data.

1. Immediate mitigations.

   • Disable Bluetooth entirely on devices where the Realtek BEE controller is not operationally required.
   • Restrict pairing/connection policy to a trusted allowlist; reject unknown or unauthenticated peers.
   • Deploy devices out of Bluetooth range of publicly accessible areas to reduce the adjacent-attacker exposure implied by AV:A.
   • Enable watchdog/auto-reboot behavior so that an induced crash recovers autonomously, and alert on unexpected reboot loops.

2. Patch/upgrade steps.

   • Continuously monitor OSV and Zephyr security advisories for CVE-2026-11894; apply the fixed hci_bee.c source and rebuild the firmware as soon as an independently confirmed fix is published.
   • Verify the fix against the buffer-ownership contract: net_buf_unref(buf) must only be invoked on the success path, and the LOG_ERR dereference of buf->len must be moved before the unref or guarded by an ownership check.
   • Stage the patched firmware in a representative test fleet before mass rollout.

3. Long-term hardening.

   • Add contract-adherence code reviews for all bt_hci_driver_api implementations, with special focus on error-path ownership semantics.
   • Run test builds with memory debugging enabled (KASAN/refcount diagnostics, net_pool assertions) during CI so that double-unref defects surface deterministically.
   • Introduce fault injection on controller send/allocation failures in the host TX path to exercise error paths under load.
   • Treat adjacent-range Bluetooth connectivity as an attack surface in threat models and segment Bluetooth-capable devices accordingly.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-11894
• OSV advisory: https://osv.dev/vulnerability/CVE-2026-11894
• CVE record (cve.org): https://www.cve.org/CVERecord?id=CVE-2026-11894
• CISA KEV: not listed (as of analysis date; no known exploitation in the wild)
• Threat-actor activity: none known; no campaigns have referenced this CVE, and the EPSS score (0.00170, 6.7th percentile) indicates low near-term exploit likelihood.