Zephyr RTOS EUVD-2026-109145

Requires a Zephyr device built with the new USB device_next stack's Bluetooth HCI transport class (subsys/usb/device_next/class/bt_hci.c) and the local controller in raw HCI mode (CONFIG_BT_HCI_RAW). The over-the-air and host-init triggers apply to full-speed-only builds from v4.2.0 onward, where USBD_MAX_BULK_MPS is 64 bytes; the overflow magnitude depends on CONFIG_BT_BUF_EVT_RX_SIZE / CONFIG_BT_BUF_ACL_RX_SIZE being larger than 64 (default EVT_RX_SIZE 68 already yields a 70-byte event). Remote attacker paths need only Bluetooth range with no authentication and no user interaction: a connected peer negotiating Data Length Extension sends ACL fragments up to CONFIG_BT_CTLR_DATA_LENGTH_MAX, or an attacker merely broadcasting LE Extended Advertising data reaches the same copy via Extended Advertising Report events. The stock full-speed-only configuration overflows by six bytes on every host initialization (mandatory 70-byte Read Supported Commands event) with no radio traffic at all. Limiting factors: code execution requires CONFIG_ASSERT=n (the usual production setting) AND no memory protection between subsystems - with CONFIG_ASSERT=y or CONFIG_NET_BUF_HARDENING=y the result is an assertion panic (denial of service) rather than silent corruption; pre-v4.2.0 and high-speed-capable builds use a 512-byte slot and need a controller-to-host ACL packet longer than 508 bytes (reachable only via an external BR/EDR controller with CONFIG_BT_BUF_ACL_RX_SIZE raised to 508+).

Signals are mostly consistent and point to an elevated-but-not-emergency priority. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 8.8) describes an unauthenticated adjacent (Bluetooth-range) out-of-bounds write with high impact, and the vuln.today Decision label is 'this_week' - serious, but below act_now/emergency. KEV status is NO (not CISA-listed), EPSS is not supplied, and no PoC or exploit reference is present (only the patch commit and the GHSA advisory), so there is no evidence of active or imminent exploitation. The impact signal is nuanced and should temper the raw 8.8: arbitrary code execution only materializes on builds with CONFIG_ASSERT=n (common in production) AND no memory protection between subsystems; on builds with assertions enabled the same overflow triggers a panic, i.e. a remotely triggerable denial of service only, so C:H/I:H is a worst-case-configuration rating rather than a universal outcome. Conversely, the availability/corruption surface is unusually easy to reach: the advisory states the stock full-speed-only configuration already overflows the 64-byte slot by six bytes on every host initialization via the 70-byte Read Supported Commands event - with no radio traffic and no attacker at all - which raises reliability/DoS risk even absent an adversary. Net: a genuine high-severity memory-safety flaw worth prompt patching on affected embedded builds, but not a widely-exploited internet-facing emergency; the adjacency requirement (Bluetooth range) and the narrow affected build configuration limit real-world blast radius.

An unauthenticated attacker within Bluetooth radio range of a Zephyr device running the controller in raw HCI mode broadcasts oversized LE Extended Advertising data (or connects and negotiates Data Length Extension to send large ACL fragments); the controller-to-host packet exceeds the 64-byte USB bulk endpoint slot and net_buf_add_mem() copies past the end of the bt_hci_ep_pool with attacker-chosen bytes. On production builds (CONFIG_ASSERT=n) without inter-subsystem memory protection this corrupts adjacent static memory and can lead to code execution; on assertion-enabled builds it panics (DoS). No public exploit code was identified at time of analysis.