CVE-2026-79982: bounds in zephyrproject zephyr

The vulnerability exists in the Bluetooth HCI USB transport class of Zephyr's new USB device stack (subsys/usb/device_next/class/bt_hci.c). The function bt_hci_tx_sync_in() allocates a buffer from a fixed-size pool (64 bytes on full-speed builds) but copies controller-to-host HCI packets that can be larger than this buffer without checking length, causing a buffer overflow. Oversized packets can be sent by an unauthenticated attacker within Bluetooth range via Data Length Extension or LE Extended Advertising Report events. In production builds without assertions, this leads to silent memory corruption adjacent to the USB buffer pool, potentially enabling arbitrary code execution. Builds with assertions enabled will panic, causing a remotely triggerable denial of service. The fix involves introducing a separate buffer pool sized to the maximum HCI buffer size for controller-to-host packets, preventing overflow.

An unauthenticated attacker within Bluetooth range can trigger a buffer overflow by sending oversized HCI packets, leading to memory corruption. On systems without memory protection between subsystems, this can result in arbitrary code execution. On systems with assertions enabled, the vulnerability causes a denial of service via panic. The vulnerability affects confidentiality, integrity, and availability of the affected system.

No explicit patch link is provided in the input data, so patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor's fix introduces a separate buffer pool sized to the maximum HCI buffer size for controller-to-host packets, preventing overflow. Until a fix is applied, enabling CONFIG_NET_BUF_HARDENING and assertions (CONFIG_ASSERT=y) can help detect and prevent silent memory corruption by causing a panic on overflow, though this results in denial of service rather than silent corruption.