The Realtek BEE Bluetooth HCI driver's send callback function (bt_hci_bee_send) in Zephyr incorrectly handled buffer ownership on error returns by unconditionally calling net_buf_unref on the transmit buffer. The host also unreferences the buffer after an error, resulting in a double-free and use-after-free scenario that corrupts the shared net_buf pool. This occurs when host-to-controller buffer allocation or controller send operations fail, typically under resource exhaustion or IO error conditions. A remote Bluetooth peer can indirectly trigger these conditions by causing heavy transmit activity. The vulnerability is limited to builds using this specific Realtek BEE HCI driver. The fix modifies the error paths to avoid unreferencing the buffer on failure, restoring the ownership contract and eliminating the memory corruption issues.

The vulnerability can cause memory corruption and device crashes due to double-free and use-after-free conditions in the Bluetooth HCI driver. This impacts device stability and availability but does not directly compromise confidentiality or integrity. The issue arises under specific error conditions related to buffer allocation or transmission failures, potentially triggered by remote Bluetooth peers through heavy transmit activity. The impact is confined to Zephyr builds using the Realtek BEE HCI driver.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix corrects the buffer ownership handling by unreferencing the transmit buffer only on successful sends and returning early on error paths without unreferencing. Users should monitor the official Zephyr project advisories for an official fix and apply updates when available. Until then, avoid configurations that heavily stress the Bluetooth transmit path if possible.