Executive brief
The Bluetooth driver for Bouffalo Lab wireless controllers contains a flaw in how it handles transmission errors. When the driver encounters a send failure, it incorrectly releases ownership of the data buffer, even though the calling code still expects to own it. This causes the same buffer to be released twice, corrupting the shared memory pool used for Bluetooth communications and potentially crashing the BLE stack on affected devices.
Technical details
The vulnerability is a buffer reference counting error in the bt_bflb_send() function (drivers/bluetooth/hci/hci_bflb.c). The HCI driver API contract requires that on send() success, the driver consumes the buffer reference; on error, the caller retains ownership and performs cleanup. This driver violates that contract by unconditionally calling net_buf_unref(buf) on all error paths, consuming the buffer even when returning an error code. When send_buf() in the host TX path (subsys/bluetooth/host/conn.c) receives an error, it performs its own net_buf_unref(), resulting in a double-decrement of the reference count. Because these buffers are TX fragments with destroy callbacks that decrement their parent buffer, premature deallocation causes a use-after-free condition on buffers still queued for transmission, corrupting the net_buf pool. The error conditions (controller TX failure or unsupported H:4 packet type) are not directly triggered by remote packets but can be influenced indirectly through heavy link load.
Affected products
- Bouffalo Lab BL60x Bluetooth Controller unspecified
- Bouffalo Lab BL70x Bluetooth Controller unspecified
- Bouffalo Lab BL61x Bluetooth Controller unspecified
Timeline
- 2026-08-11: disclosed: CVE-2026-11893 published