CVE-2026-78117: race in zephyrproject zephyr

The Infineon PSOC 6 BLESS HCI driver in Zephyr stores outgoing HCI packet descriptors in a static file-scope variable, which is accessed without proper synchronization before acquiring the serializing semaphore. This allows concurrent senders to interleave operations, causing the controller to transmit data from mismatched or already freed buffers. The consequence is disclosure of adjacent RAM contents to a connected Bluetooth peer and disruption of the link through packet duplication or loss. The vulnerability affects Zephyr versions >=3.4.0 and <=4.4.2. The patch changes the descriptor to a local variable within the sending function, ensuring no shared state is accessed concurrently. The CVSS 3.1 score is 4.2 (medium severity), reflecting low confidentiality impact, no integrity impact, and low availability impact.

An attacker connected via Bluetooth may receive unintended adjacent RAM contents due to the race condition in packet descriptor handling, leading to limited information disclosure. Additionally, packet duplication and silent drops can disrupt Bluetooth link reliability. There is no memory corruption or write primitive, and the disclosed data is not attacker-controlled, limiting the severity of impact.

A fix is available that changes the shared packet descriptor to a local variable within the sending function, removing the race condition. Users should upgrade to a Zephyr version later than 4.4.2 or apply the vendor's patch if available. Since the vulnerability arises from driver code, applying the official fix is the recommended mitigation. Patch status is not explicitly confirmed in the provided data; check the Zephyr project advisory for the latest remediation guidance.