Description
The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cy_stc_ble_hci_tx_packet_info_t hci_tx_pkt. psoc6_bless_send() cleared and populated that descriptor's packetType, dataLength and data fields before acquiring psoc6_bless_operation_sem, so the driver's serialising semaphore protected only the call into Cy_BLE_SoftHciSendAppPkt() and not the shared state that call reads.

The Bluetooth host does not guarantee a single HCI sender. Most transmissions are funnelled through the cooperative TX-processor work queue, but bt_hci_cmd_send() deliberately bypasses bt_dev.cmd_tx_queue for BT_HCI_OP_HOST_NUM_COMPLETED_PACKETS and calls bt_send() directly from the caller's thread; that caller is bt_hci_host_num_completed_packets(), the acl_in_pool destroy callback, which runs on whichever thread drops the last reference to a received ACL buffer. CONFIG_BT_HCI_ACL_FLOW_CONTROL defaults to y on this driver's boards, and an application that returns -EINPROGRESS from its L2CAP recv callback and later calls bt_l2cap_chan_recv_complete() performs that unref from its own preemptible thread. A remote peer that generates Bluetooth traffic concurrently with the device's own transmissions raises the collision rate.

When two senders interleave, the semaphore holder can hand the controller a descriptor whose dataLength comes from one net_buf and whose data pointer comes from another — or one whose buffer has already been returned to its pool. The controller then copies and transmits up to a full HCI/ACL payload starting at a shorter or recycled buffer, disclosing adjacent RAM contents to the connected peer; other interleavings duplicate one HCI packet and silently drop another, disrupting the link. The driver only reads through the shared descriptor, so no memory corruption or write primitive results, and the disclosed bytes are not attacker-chosen. The fix makes the descriptor a local variable in psoc6_bless_send(), removing the shared state; Cy_BLE_SoftHciSendAppPkt() copies the packet before returning, so it need not outlive the call.
Published: 2026-10-21
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure via adjacent memory leak over the air
Action: Apply Patch
AI Analysis

Impact

A race condition in the Infineon PSOC 6 BLESS Bluetooth driver allows an attacker to trigger concurrent HCI packet transmissions that mix packet length and data pointers within a shared descriptor variable. Because the driver only reads through this descriptor, no memory corruption occurs, but the controller may copy and transmit a longer or recycled buffer, leaking nearby RAM contents to a connected peer. The vulnerability does not allow arbitrary code execution, yet it exposes potentially sensitive data to a remote Bluetooth client.

Affected Systems

Zephyr applications that use the Infineon PSOC 6 BLESS driver (drivers/bluetooth/hci/hci_infineon_psoc6_bless.c). Devices built with the default configuration where CONFIG_BT_HCI_ACL_FLOW_CONTROL is enabled and that employ concurrent HCI send paths such as bt_hci_cmd_send(), L2CAP receive callbacks, or the acl_in_pool destroy callback are affected. The issue manifests in Zephyr builds that include the shared static hci_tx_pkt descriptor.

Risk and Exploitability

The vulnerability is scored CVSS 4.2, indicating low to moderate overall risk. EPSS data is not available and the flaw is not listed in the CISA KEV catalog. The likelihood of exploitation hinges on an attacker’s ability to introduce concurrent HCI traffic—such as a remote Bluetooth peer that sends simultaneous packets—to trigger the race condition. Although no attacker‑chosen data is transmitted, the exposed memory content could reveal sensitive firmware or system information.

Generated by OpenCVE AI on October 22, 2026 at 04:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Zephyr codebase to incorporate the patch that moves the hci_tx_pkt descriptor from file scope to a local variable in psoc6_bless_send() (see commit 7d0efa35134141bb1b1527f9078d2bc19e67168e).
  • If upgrading is not immediately possible, modify the build configuration to serialize HCI packet sending: disable CONFIG_BT_HCI_ACL_FLOW_CONTROL or ensure that only a single thread invokes bt_hci_cmd_send() so that the shared descriptor cannot be accessed concurrently.
  • Continuously monitor Bluetooth traffic for duplicated or malformed ACL packets; if anomalies persist, temporarily block the driver or limit the device to a single HCI sender until a permanent patch is applied.

Generated by OpenCVE AI on October 22, 2026 at 04:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Wed, 21 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cy_stc_ble_hci_tx_packet_info_t hci_tx_pkt. psoc6_bless_send() cleared and populated that descriptor's packetType, dataLength and data fields before acquiring psoc6_bless_operation_sem, so the driver's serialising semaphore protected only the call into Cy_BLE_SoftHciSendAppPkt() and not the shared state that call reads. The Bluetooth host does not guarantee a single HCI sender. Most transmissions are funnelled through the cooperative TX-processor work queue, but bt_hci_cmd_send() deliberately bypasses bt_dev.cmd_tx_queue for BT_HCI_OP_HOST_NUM_COMPLETED_PACKETS and calls bt_send() directly from the caller's thread; that caller is bt_hci_host_num_completed_packets(), the acl_in_pool destroy callback, which runs on whichever thread drops the last reference to a received ACL buffer. CONFIG_BT_HCI_ACL_FLOW_CONTROL defaults to y on this driver's boards, and an application that returns -EINPROGRESS from its L2CAP recv callback and later calls bt_l2cap_chan_recv_complete() performs that unref from its own preemptible thread. A remote peer that generates Bluetooth traffic concurrently with the device's own transmissions raises the collision rate. When two senders interleave, the semaphore holder can hand the controller a descriptor whose dataLength comes from one net_buf and whose data pointer comes from another — or one whose buffer has already been returned to its pool. The controller then copies and transmits up to a full HCI/ACL payload starting at a shorter or recycled buffer, disclosing adjacent RAM contents to the connected peer; other interleavings duplicate one HCI packet and silently drop another, disrupting the link. The driver only reads through the shared descriptor, so no memory corruption or write primitive results, and the disclosed bytes are not attacker-chosen. The fix makes the descriptor a local variable in psoc6_bless_send(), removing the shared state; Cy_BLE_SoftHciSendAppPkt() copies the packet before returning, so it need not outlive the call.
Title Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air
Weaknesses CWE-362
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-11-04T05:01:18.190Z

Reserved: 2026-08-22T20:22:59.340Z

Link: CVE-2026-78117

cve-icon Vulnrichment

Updated: 2026-10-23T20:42:56.469Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T19:17:03.653

Modified: 2026-11-04T05:19:02.340

Link: CVE-2026-78117

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T10:30:04Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')