Zephyr RTOS CVE-2026-78117

Exploitation requires the Infineon PSOC 6 BLESS HCI driver (hci_infineon_psoc6_bless.c) with CONFIG_BT_HCI_ACL_FLOW_CONTROL=y (the default on this driver's boards), plus an application that returns -EINPROGRESS from its L2CAP recv callback and later calls bt_l2cap_chan_recv_complete(), so the ACL buffer unref - and the resulting bt_hci_host_num_completed_packets() direct bt_send() - runs on a preemptible thread concurrent with other HCI transmissions. An attacker must be a connected BLE peer within adjacent radio range generating concurrent traffic to raise the collision rate. Limiting factors: the window is a narrow timing race (AC:H) that is not reliably controllable, the disclosed bytes are adjacent/recycled RAM and are not attacker-chosen, impact is limited to a single connected peer, and deployments using the default cooperative TX-processor work queue without the -EINPROGRESS/recv_complete pattern are far less exposed.

This is a genuine but low-priority defect. The input CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L, base 4.2 / Medium) is internally consistent with the description: exploitation is confined to Bluetooth adjacent range (AV:A), hinges on winning a hard-to-control concurrency race between two HCI senders (AC:H), needs no authentication beyond an established BLE connection (PR:N), and yields only low-impact information disclosure of non-attacker-chosen adjacent RAM (C:L) or transient link disruption (A:L) with no write/corruption primitive (I:N). No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. All exploitation signals point the same direction - low real-world risk - with no conflict between CVSS, EPSS (absent), and KEV (absent). The combination of adjacent-only vector, high attack complexity (a race that depends on precise interleaving), narrow affected hardware, and a required non-default application behavior places this well below internet-facing or wormable issues despite its unauthenticated nature. Treat as a routine patch-when-convenient item for affected Infineon PSOC 6 BLESS deployments rather than an emergency.

A malicious or compromised BLE peer within radio range connects to an affected Infineon PSOC 6 device and deliberately floods it with concurrent ACL traffic while the device performs its own transmissions, aiming to interleave two HCI senders so the shared file-scope descriptor pairs one buffer's dataLength with another's (or an already-freed) data pointer. If the race is won, the controller transmits bytes of adjacent or recycled RAM back to the peer; other interleavings instead duplicate or drop HCI packets and disrupt the link. No public exploit code exists, the race is hard to win (AC:H), and the leaked bytes are not attacker-chosen.